How Edilec protects its systems and client data.

Every company account uses phishing-resistant multi-factor authentication (hardware security keys or passkeys) behind company-wide single sign-on. Credentials are short-lived; there are no shared or long-lived keys.

• Phishing-resistant MFA
• Single sign-on
• No shared keys

Everyone doing client work uses a company-managed, encrypted device. Company policy controls which devices and apps can be used, and staff with access to client systems pass background checks.

• Managed, encrypted devices
• Device and app control
• Background checks

Systems used for authorized security testing can reach only approved destinations through outbound allowlists, and testing stays inside each client's signed authorization.

• Outbound allowlists
• Signed authorization
• Scoped testing

Access follows least privilege and is reviewed regularly. Access and security events are logged centrally. Client data is encrypted in transit and at rest and deleted at the end of the period agreed in each contract.

• Least privilege
• Central logging
• Encrypted client data

If you think you have found a security issue in an Edilec website, product or service, email security@edilec.com with the affected URL or component, steps to reproduce and the impact. We acknowledge reports within one business day and keep you updated until the issue is fixed. Please do not access or change data that is not yours, disrupt our services, or disclose the issue publicly before it is fixed. We will not take legal action against good-faith research that follows this policy. In scope: edilec.com, uynis.com and the Edilec client portal. Out of scope: denial of service, social engineering and physical attacks.

• security@edilec.com
• Reply within one business day
• Good-faith research protected