We handle sensitive data for Fortune 500 brands. This page sets out exactly how Epical secures it: where it lives, who can touch it, how confidentiality is enforced, and what happens if anything goes wrong. No vague assurances. A written protocol your CISO can read before the first brief.
Every Epical analysis is built on official platform APIs (Meta, X) and publicly accessible sources. We never scrape private content, never breach platform terms of service, and never touch leaks or gray-market data. This isn't a values statement. It's the condition that keeps our work legally usable by your legal and compliance teams.
Each engagement runs in its own isolated environment. The ingested data, working files, and deliverables for one client are never accessible to another, and never train a model another client will see. Our proprietary AI is trained on regional public conversation. Your data stays yours and never feeds the shared model.
By default, project data lives on cloud infrastructure in Argentina (Buenos Aires) with backup in Uruguay. Need EU or US residency for a specific requirement? We provision it in Spain or the United States. Everything is encrypted in transit (TLS 1.3) and at rest (AES-256).
When an engagement ends, raw ingestion data is archived encrypted and automatically purged after 12 months, unless we agree otherwise in writing. Deliverables (reports, briefs, the decisions they enabled) are retained by contract, on terms you control. They are never unilaterally ours.
Triggered by internal alert, client report, or subprocessor notice. Immediate escalation to senior leadership and the Operations Lead.
Isolation of the affected project. Suspension of processing. Evidence preservation. Lockdown of potentially compromised access.
If client data is potentially affected, we notify your contractual counterparty directly, with a preliminary report and a response plan.
When legally required, we notify within the timeframes mandated by the applicable jurisdiction.
Documented root-cause analysis, remediation plan, review of internal controls. Report shared with the affected client.
We'd rather be precise than oversell. Epical is a 16-specialist intelligence partner, not a security vendor. We don't run a 24/7 SOC or an on-call security team. Our protocol operates during extended business hours across LATAM, with direct escalation to senior leadership outside them. The times above are business-hours response targets, not platform SLAs. If your requirement is a dedicated SOC, we'll point you to specialized partners.