Security Built Into the EXP Platform.
Security is part of how EXP is built, not an add-on. This page states only what we can substantiate — and clearly distinguishes what is certified, compliant, designed to support, readiness, or architecture inspired by.
Platform Security
How EXP Protects Your Data
Verified information about the controls built into the EXP platform.
Data Protection
Customer data is segregated by tenant and protected at rest and in transit.
Encryption
AES-256 encryption at rest and TLS in transit across the platform.
Authentication
Password-based authentication with optional two-factor authentication for user accounts.
Permissions
Granular permissions control what each user can see and do within an application.
Role-Based Access
Roles group permissions so access is assigned by job function, not per individual ad hoc.
Hosting & Infrastructure
EXP runs on cloud infrastructure with monitoring, redundancy, and isolation between tenants.
Backups
Data is backed up on a regular schedule to support recovery in the event of failure.
Privacy
Customer data is not sold. Data handling follows the EXP privacy policy and customer agreements.
Incident Response
A documented incident response process covers detection, containment, communication, and review.
Business Continuity
Redundancy and backups are designed to keep the platform available and recoverable.
Compliance Status
Compliance relationships are stated precisely — see the table below. We do not claim certifications we have not earned.
Subprocessors
A current list of subprocessors is available to customers under agreement on request.
Compliance Status
Precise Compliance Language
We do not display a certification logo unless EXP holds that certification or is authorized to display it. Each item below states the exact relationship.
| Standard / Control | Classification | Detail |
|---|---|---|
| AES-256 Encryption | Architecture | Encryption applied to data at rest and in transit as a platform feature. |
| SOC 2 | Architecture inspired by | EXP controls are designed with SOC 2 principles in mind. EXP does not currently hold a SOC 2 attestation. |
| GDPR | Designed to support | Platform features and data handling are designed to support GDPR obligations for customers operating under GDPR. |
| HIPAA | Readiness | HIPAA-Ready: the platform can be configured to support HIPAA-aligned workloads. A BAA is arranged when required. |
| DCAA Timekeeping | Designed to support | Timepilot IQ produces immutable, contemporaneous audit trails designed to support government contractor timekeeping requirements. EXP does not claim government certification. |
| ISO 27001 | Not certified | EXP does not currently hold ISO 27001 certification. |
Certified
EXP holds an active attestation.
Compliant
EXP meets the requirements of the standard.
Designed to support
Platform features support customer obligations.
Readiness
Can be configured for an aligned workload.
SECURITY CONTACT
Report a Security Concern
If you believe you have found a security vulnerability or have a security concern about an EXP application, contact our security team directly. We take every report seriously.