Security controls for responsible AI implementation.
EPILO.ONE treats security as part of the operating model: access control, route boundaries, server-side secrets, hardened browser responses, and documented implementation governance.
Control baseline.
The controls below describe the current public website and application baseline. Engagement-specific controls can be documented during assessment and implementation.
Managed cloud runtime
The production site runs as a containerized Next.js service on Google Cloud Run. The application is shipped as a standalone server bundle with only traced runtime dependencies.
Transport and browser hardening
HTTPS is enforced at the platform edge. Responses include HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and a restrictive Permissions-Policy.
Authenticated workspaces
Client workspaces, the Lab, dashboard, and CMS console require Firebase Authentication. Administrative access is restricted by Firestore role checks and verified bootstrap allowlists.
Database access control
Firestore rules follow a default-deny model with typed validators for users, projects, briefs, reports, inquiries, CMS content, and project membership.
Server-side AI processing
The Lab analysis route runs on the Node.js server runtime. Model credentials stay server-side and requests require a verified Firebase bearer token before analysis starts.
Crawl boundary controls
Private routes are excluded from the sitemap, disallowed in robots.txt, marked with page-level noindex metadata, and returned with X-Robots-Tag noindex headers.
Contact data handling
Contact form submissions are sent through the configured Web3Forms access key and persisted to Firestore for operational follow-up when database persistence succeeds.
Implementation governance
Assessments define scope, ownership, review points, human oversight, and change-control expectations before an AI workflow is implemented.
Verified response headers.
Production responses are configured to return the following security headers on every route. Private application routes additionally return `X-Robots-Tag: noindex, nofollow`.
Responsible disclosure.
If you believe you have found a vulnerability affecting EPILO.ONE, report it through the contact route and include enough detail to reproduce the issue. Please avoid destructive testing, data access attempts, denial-of-service activity, or testing against accounts you do not own.
Security and procurement requests, including architecture notes, DPA requests, and subprocessor questions, are handled through the assessment intake process.