Security and privacy

Your data stays yours.

EVC handles sensitive information about how an organisation works. We designed it so the people who own that information stay in control of it.

Principles

Privacy by design, not by policy.

End-to-end encrypted wallets

Keys stay with department representatives and employees. The server and the tenant administrator cannot read wallet content.

Analytics from summaries, not content

A department owner publishes a period summary explicitly, after a preview: aggregates by flow, no event text, no names. Reaction distributions appear only from three answers.

No people rankings

No leaderboards, no places, no comparison of people. Built into the product, not left to settings.

Cloud in the EU

Hosted in the EU with tenant isolation: a separate database schema per tenant. We act as a processor under a data processing agreement.

Or fully on-premise

Run EVC in your own infrastructure, including closed networks. We do not see or process your data. Telemetry is off by default.

Export anytime

All tenant data in open formats, JSON and CSV. You can delete the tenant. An expired licence never locks your data.

Access and audit

Email with 2FA, SSO over OIDC or SAML, SCIM provisioning. Permissions are role times object, checked on every request. An exportable audit log.

AI never scores people

AI features may suggest events. They never rate or rank people.

No third-party trackers

No third-party analytics or advertising SDKs, in the product or on this site.

Employee work wallets

Introduced with care.

A department decides whether to turn on work wallets for its employees. Before that, every employee gets a clear notice. Rules for who sees what are fixed in the product.

  • The notice explains what is tracked, who sees what, how to dispute and how to delete.
  • The employee holds the keys to their work wallet. It is separate from any personal wallet.
  • Colleagues do not see each other's contribution.
  • Leadership sees employee contribution only as a department aggregate.
  • We provide a rollout pack: an impact assessment template, an employee notice, a description for works councils.

Security baseline

What we build against.

  • OWASP ASVS level 2 as the application security target.
  • An external penetration test before the first Enterprise contract.
  • A software bill of materials (SBOM) with every release.
  • Signed releases for on-premise delivery.
  • Certifications will be listed here once obtained. We do not claim what we do not have.

Request a demo

See EVC on your own structure.

Tell us about your organisation. We will show EVC on an example close to yours and suggest a pilot: one department, two recipient departments, two periods.

  • A 45-minute call with a walkthrough on a generic example.
  • Cloud (EU) or on-premise, your choice.
  • Pricing on request, sized to your structure.

We use these details only to reply to you. See the privacy notice.