We work with sensitive information from global brands. This page documents how we handle data, what happens with confidentiality, and which regulatory frameworks we operate under. No empty promises. A written protocol.
All of Epical's analysis is built on official platform and network APIs (Meta, X) and publicly accessible sources. We don't scrape private content, we don't violate platform terms of service, and we don't use data leaks or dubious sources. This isn't an ethical commitment: it's a condition for our work to be legally usable by the client.
Each project runs in an isolated environment. The ingested data, intermediate results, and deliverables for client A are not accessible to, nor do they train models that client B will see. Our proprietary models are trained on regional public conversation; client-specific data does not feed the shared model.
By default, project data lives on cloud infrastructure in Argentina (Buenos Aires) with backup in Uruguay. For clients with specific requirements we offer residency in Spain or the US. All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
When a project ends, ingestion data is archived in encrypted format and automatically purged after 12 months, unless agreed otherwise. We retain client deliverables (reports, briefs, enabled decisions) by contract; they are not unilaterally ours.
Detection via internal alert, client report, or subprocessor notice. Immediate escalation to senior leadership and the Operations Lead.
Isolation of the affected project. Suspension of processing. Evidence preservation. Lockdown of potentially compromised access.
If there is potential impact on client data, direct notification to the contractual counterparty with a preliminary report and a response plan.
When legally required, we notify within the timeframes mandated by the applicable jurisdiction.
Documented root-cause analysis, remediation plan, review of internal controls. Report shared with the affected client.
Epical is a 16-specialist intelligence partner. We don't operate a 24/7 SOC or a dedicated on-call security team. Our response protocol operates during extended business hours in LATAM, with direct escalation to senior leadership outside those hours. The committed times are business-hours response times, not platform SLAs. For clients with dedicated SOC requirements, we refer to specialized partners.