Security & data isolation
Built so your IT lead can say yes
This page is written for the person who has to sign off. It covers where data lives, who can see it, how writes are gated, and what we depend on. Forward it.
A dedicated server per customer
Each company gets its own isolated compute, storage, and encryption keys at its own address (yourcompany.epicone.hearken.ai). The central hub only routes sign-ins and monitors health. Your data never passes through it, and no customer server ever connects to another. Users, conversations, documents, and ERP records live on your server and nowhere else.
Access scoped to each user’s own login
Epic One works with each user’s own ERP and CRM credentials. A person can ask about exactly the records their existing login permits. The permission lines your systems already draw carry over unchanged. There is no shared master account and no way to see more through Epic One than you could see directly.
The approval gate on every write
Reads are instant. Writes are not: before any ERP record is created or changed, Epic One shows the exact change and waits for a human to approve it. Then it executes, verifies the result, and logs it. Every read, write, and attempted operation lands in the audit log. New procedures rehearse in a test environment first, then run their first production pass under the supervision of a named team member.
Encryption, on your server
Per-company encryption keys are generated on your server at creation and never leave it. Stored ERP and portal credentials get an additional layer of encryption inside the database. Passwords become salted one-way hashes using scrypt, a memory-hard algorithm, verified only on your server, and password fields stay masked everywhere you enter one, including in chat. Nightly backups are encrypted at rest on per-customer isolated storage paths.
What our own team can and cannot see
Our operations team can see server health, usage totals for billing, and the sign-in directory (name, phone, company, admin status). It cannot see conversations, documents, credentials, or ERP data. Code updates roll out in stages through a data-free canary server before reaching any customer instance.
Sign-in protection
Team members sign in with phone, company, and password. Password checks happen only on your server, and sessions bind cryptographically to your company’s server, so a token from one company is unusable at another. The central directory holds only name, phone, company, and admin status for routing — no password or hash ever leaves your server. Repeated failed attempts trigger temporary locks at both the central and local levels. Temporary onboarding passwords are randomly generated and must be replaced at first login.
Every change walks this path
- 1
Preview
exact change shown
- 2
Approve
a person says yes
- 3
Execute
the update runs
- 4
Verify
result double-checked
- 5
Log
written to the audit trail
Reads never take this path; questions are answered instantly and change nothing.
Questions IT teams ask us
Is our data used to train AI models?+
No. Epic One processes language through Anthropic’s commercial Claude API, whose terms prohibit training models on customer data.
What third-party services does Epic One depend on?+
Anthropic’s Claude API for AI processing (no training on customer data), DigitalOcean for hosting, Twilio for SMS, Microsoft 365 for email, Let’s Encrypt for certificates, and Dropbox only if your company chooses to connect it.
Can Epic One break our ERP?+
It cannot change a record without a person approving the previewed change first, and new procedures rehearse in a test environment before their first production run. Every action is logged, so there is always a trail.
What happens to our data if we leave?+
Your data lives on your own server. When service ends, we provide a complete export using the same migration tooling we use operationally, then delete your server. Any retained backups age out on the schedule set in your agreement.
Who decides which of our people get access?+
Your company administrator. Your team registers themselves once your instance is live, and your admin approves each of them from your own admin page.
Want to go deeper?
We'll walk your IT lead through the architecture on the setup call, before anything connects to your ERP.