Security Policy

1. SECURITY GOVERNANCE
EAlert365 manages security as a continuous govern, identify, protect, detect, respond, and recover process. Controls are risk-based and are reviewed after material system changes, incidents, test findings, or significant threat changes. No internet service can promise absolute security.

2. ACCESS AND TENANT CONTROLS
The service uses encrypted transport, authenticated sessions, role-based permissions, tenant-aware authorization checks, and protected privileged workflows. The current sign-in flow uses a password plus an emailed one-time code. Administrators must grant least privilege, review access, remove departed users, and protect administrator email and devices.

3. OPERATIONS AND RESILIENCE
Treea LLC uses monitoring, controlled updates, backups, recovery procedures, and incident handling to reduce confidentiality, integrity, and availability risk. Security logs and operational records are access-controlled and retained according to purpose and legal requirements. Customers remain responsible for device security, accurate contacts, tested escalation paths, and lawful workspace configuration.

4. INCIDENT HANDLING
Security events are triaged, contained, investigated, remediated, recovered, and reviewed. Designated customer contacts will be notified of confirmed personal-data incidents without undue delay as required by applicable law and contract, with practical information as it becomes available.

5. RESPONSIBLE DISCLOSURE
Report a suspected vulnerability through Contact in the website footer. Choose the Security category and include “Security Vulnerability Report,” the affected URL or component, impact, and reproducible steps. Keep the returned ticket reference. Do not include secrets or customer data. Good-faith testing is authorized only for accounts and data you own or have explicit permission to test; it must avoid privacy violations, persistence, social engineering, denial of service, destructive actions, or access beyond the minimum needed to demonstrate the issue. Allow reasonable time for investigation and coordinated disclosure.

6. SECURITY QUESTIONS
Never send a password, one-time code, private key, access token, or full payment-card number to EAlert365 support. For a suspected account compromise, change the password, secure the associated email account, sign out other sessions where available, notify the workspace administrator, and submit a security ticket with the time and visible symptoms.