Resources
Policies are published in full. Documents with a lock are shared on request: click one, or use Request access, and we email it to you after a short check of who is asking.
Reports
- Penetration test summary
Independent white-box test of the web application by Aikido Security, October 2026. Etropo fixed 32 of the 35 findings and Aikido retested each fix. Etropo accepted the other 3 with a documented reason, given in the full report.
The full October 2026 report: every finding with its severity, CVSS score and business impact, and its retest result or the reason it was accepted.
Shared on request
General
- Architecture and data flow overviewv1.0
Where the application runs, where data is stored, and which vendor sees what.
Which models are used, what data reaches them and when, provider terms, retention, and the controls around AI features.
Shared on request
Every system, data store, repository, domain, scheduled job and class of secret Etropo depends on, with its owner.
Shared on request
The required and observed state of every security-relevant setting on Vercel, Supabase, GitHub and in the application.
Shared on request
- Data Processing Agreement (DPA)v1.0
The terms under which Etropo processes personal data on a customer’s behalf, with the EU Standard Contractual Clauses incorporated and the subprocessor list as an annex. Takes effect with the Terms of Service; a countersigned copy is available on request.
- Privacy Policy
What personal data is collected, why, for how long, and your rights. Published on www.etropo.com.
Policies
- Information Security Policyv1.1
The top-level policy: scope, roles, and the requirements every other policy expands on.
- Access Control Policyv1.0
Who gets access to what, how it is granted, reviewed and removed, for customers and for Etropo personnel.
- Secure Development and Change Management Policyv1.1
How code is written, reviewed, tested and deployed, and how it is rolled back.
- Security Incident Response Planv1.0
Severity levels, response targets, the steps from detection to post-incident review, and breach notification.
- Business Continuity and Disaster Recovery Planv1.0
Recovery objectives, backup arrangements and the procedures for the failure scenarios that matter.
- Cryptography and Key Management Policyv1.0
Encryption in transit and at rest, application-level encryption, hashing, and how keys are stored and rotated.
- Data Management, Classification and Retention Policyv1.1
Data classes, handling rules, retention periods, deletion and export.
- Third-Party and Vendor Management Policyv1.0
How vendors are chosen, reviewed and listed, and how customers are told about changes.
- Risk Management Policyv1.0
How risks to customer data are identified, rated, treated and reviewed.
- Acceptable Use Policyv1.0
Rules for personnel and contractors who use Etropo systems or handle customer data.
- Responsible Disclosure Policyv1.0
How to report a vulnerability, what we commit to, and what we ask of researchers.
- Information Security Roles and Responsibilitiesv1.0
The Security Lead, the Infrastructure Lead and everyone else: who is accountable for what, and the current state of coverage.
- Human Resource Security Policyv1.0
What happens before, during and after a person has access to customer data: agreements, onboarding, training, offboarding.
Logging, monitoring, scheduled jobs, backups, patching, capacity and the recurring operational checks.
Shared on request
- Code of Conductv1.0
How we work and treat customers, colleagues and their data. Acknowledged by every employee and contractor on joining.
- Confidentiality Agreementv1.0
The plain-language confidentiality terms every person with access to Etropo systems or customer data signs.