Security

Security at Eqlo, encryption, access and incidents

Eqlo encrypts project data at rest and in transit and keeps secrets encrypted. You pick the European Union, the United States, or the United Kingdom at creation. Daily backups stay for 30 days. You can export the whole project at any time. This page names those controls and what we do not claim.

  • 3Regions at creation
  • 30Days of backups
  • 1 / 3 / 10Seats by plan
  • hello@eqlo.appIncident mail

Encryption of data and secrets

Encryption of data and secrets covers two layers that you can name. Data sits encrypted at rest and travels encrypted in transit. Integration keys and environment variables are stored encrypted, with a separate set per environment.

That baseline is not a substitute for the region you pick, and it is not a reason to paste a column you should never have imported. A TLS tick does not make a passport tab safe.

You can export the whole project whenever you want. Export is ordinary files. It is not a second encrypted vault we invent for a brochure.

Project settings showing encrypted secrets and a region already set
The project settings screen: region chosen at creation, secrets stored encrypted, export available.

Who can access what

Who can access what is decided by the mailbox you sign in with and by the seat you assign. Sign-in is email, Google, or Apple, with a forgotten-password path and address verification. A shared team password is how a draft becomes a second product.

Invitation is by email. Roles on a project are reader, editor, and administrator. Free is 1 seat. Plus is 3 seats. Team is 10 seats. When someone leaves, you remove the seat. A forwarded URL is not a control.

Support sees a project when you invite us or when a host alert names it. We do not read a restaurant menu for sport. We do not train a public model on your inbox because a demo looked useful.

Roles on a project

Reader, editor, administrator. A commenter is not an editor. Finer rules, such as a field only two people see, need a developer to take over.

Activity and access logs

An activity log records who published, who exported, and who changed a role. A full processing register remains your programme.

Backups and restore

Backups and restore start from a daily copy kept for 30 days. That window is the one we can name. It is not an archive of every sentence you ever typed.

Each chat exchange also creates a version you can restore in one click. Visual comparison between two versions exists so you can see what changed before you keep it.

Restore of a backup is a support thread, not a silent undo of a whole workspace. Write to hello@eqlo.app with the project URL and the day you need. We will not invent a self-serve time machine on this page.

Incidents and communication

Incidents and communication live on the status page when we have something public to write. Green means we have no open incident to name. It is a dated notice, not a live probe of every tenant.

If you found a flaw in the editor or on eqlo.app, write through the contact page with a URL and steps we can replay. Do not attach customer files. Do not paste a password. A public fix gets a date on the changelog.

A lawful request is answered with what we hold, not with a story. We do not sell project copy.

What you can audit

What you can audit today is the region on the project, the seat list, the access log, the version history, and a full export. Those are checkable without a questionnaire.

We do not publish a pentest PDF on this URL. We do not claim SOC 2 or ISO 27001 on a page that would have to invent the date. If a questionnaire needs those, write through contact and we will answer with what is true that week.

Single sign-on, a private cloud, or a contract that names a DPA is an enterprise conversation. The enterprise page is the commercial door. This page is the public baseline.

Related pages

Security is the control list. Residency, privacy, and enterprise carry the geography, the legal sentences, and the paper.

Frequently asked questions

Do you have a public status page?

Yes. It is a dated notice, not a live probe. Green means we have no open incident to write.

Can I bring my own encryption key?

Not on the public plans. That request is an enterprise thread, and a reason to keep some workloads off Eqlo.

What happens if a laptop is stolen?

Revoke the seat. Reset the mailbox. Export is still yours. We cannot wipe a file that already left.

Do you scan customer projects?

We scan for abuse that puts other tenants at risk. We do not read a restaurant menu for fun. Terms cover the line.

Read residency, then start the project.

Five free projects, no card. Pick the region before you paste a sheet.