Purpose and scope
DigitalRow Technologies develops and operates EOM. This Policy provides a public overview of the practices used to manage security risk and the expectations that apply to Customers, users, and security researchers.
It applies to the public EOM website, EOM platform, EOM-controlled APIs, and supporting systems that DigitalRow authorises for use. It does not authorise testing of Meta, WhatsApp, a Customer's systems, or any other third-party service.
Security principles
Our security programme is guided by the following principles:
- select safeguards according to risk and the nature of the service;
- limit access according to legitimate responsibilities;
- use layered safeguards and secure defaults where practicable;
- record ownership and accountability for security work; and
- review incidents, vulnerabilities, and changes to improve over time.
This Policy is an overview, not a guarantee that a service will never experience an incident or vulnerability.
Data protection
We select technical and organisational measures intended to protect information against accidental or unlawful loss, alteration, disclosure, or access. Depending on the system and risk, these measures may include secure transmission, access restrictions, data minimisation, logical separation, protected backups, logging, and retention controls.
Information is intended to be accessible only to authorised people and systems for legitimate purposes. Our handling of personal information is described further in the Privacy Policy.
Identity and access
Access to EOM-controlled systems is assigned according to role and operational need. We seek to manage credentials appropriately, review access where warranted, and remove access when it is no longer needed. Additional authentication controls may be used according to system capability and risk.
Customers are responsible for selecting their authorised users, assigning suitable permissions, and promptly removing people who should no longer have access.
Application and infrastructure security
Security considerations are incorporated into the development and operation of EOM. Relevant practices may include source review, dependency and vulnerability review, configuration management, environment separation, patching, change control, logging, monitoring, and remediation based on assessed severity.
We review reports and security information that could materially affect EOM and prioritise work using the available evidence, likely impact, exploitability, and protective alternatives.
Operational resilience
We maintain operational processes intended to support backup, restoration, incident preparedness, service recovery, and learning from significant interruptions. The measures appropriate to a service depend on its architecture, dependencies, and agreed commercial terms.
No specific uptime, recovery-time, or recovery-point commitment is made by this Policy. Any binding service level must appear in a separate written agreement.
Third-party risk
EOM depends on third parties such as infrastructure providers, Meta/WhatsApp, communications services, and integrations selected by a Customer. We consider provider risk in light of the service, access, and information involved and use contractual or technical safeguards where appropriate.
Third parties control their own systems, policies, changes, and incidents. Customers should evaluate and configure their selected integrations carefully.
Personnel and confidentiality
Access to non-public EOM and Customer information is intended to be limited to personnel and contractors with a legitimate need. Relevant personnel are subject to appropriate confidentiality, acceptable-use, and security responsibilities for their roles.
Incident response
Our incident process is intended to support identification, triage, containment, investigation, recovery, documentation, and follow-up. Where an incident affects personal information or a Customer service, we provide legally required notifications and relevant cooperation according to the circumstances.
Customers must cooperate where an incident involves their systems, credentials, users, instructions, or third-party integrations and must avoid actions that could destroy relevant evidence.
Customer responsibilities
EOM Customers and users are expected to:
- protect credentials, devices, networks, and connected endpoints;
- manage authorised users and permissions according to job responsibilities;
- configure integrations carefully and protect API keys, tokens, and secrets;
- maintain lawful recipient consent and accurate WhatsApp or messaging configurations;
- review AI-assisted output and business-critical actions before relying on them; and
- report suspicious activity, credential loss, or possible security incidents promptly.
Responsible disclosure
We welcome clear, good-faith reports that help us investigate a suspected EOM vulnerability. Submit a report through the Contact Us page and begin the message with “Security vulnerability”.
A useful report includes:
- the affected URL, API, feature, or component;
- the prerequisites and exact reproduction steps;
- the observed and potential security impact;
- concise evidence, with secrets and unrelated personal data removed; and
- a safe way to contact the reporter for follow-up.
Do not include live credentials, unnecessary personal information, or exploit data that creates additional risk.
Permitted research
Good-faith research must be limited to accounts, information, and systems that you own or are expressly authorised to test. Use the minimum interaction needed to demonstrate the issue, protect all information encountered, and stop immediately if testing exposes personal data, confidential information, or service instability.
Give us a reasonable opportunity to investigate and address a validated issue before discussing it publicly. Ask us before taking any action that could reasonably affect another person or system.
Prohibited testing
This Policy does not authorise:
- denial-of-service, load, stress, destructive, or availability testing;
- social engineering, phishing, spam, credential attacks, malware, or persistence;
- physical attacks against offices, personnel, or equipment;
- broad automated scanning, mass account creation, or testing that degrades service;
- accessing, changing, downloading, retaining, or sharing another person's information; or
- testing third-party systems or publicly disclosing an unresolved issue without coordination.
Our response process
We aim to acknowledge and triage credible reports as resources permit, request clarification when necessary, investigate validated findings, prioritise remediation according to risk, and coordinate appropriate disclosure with the reporter.
The complexity and impact of findings vary, so this Policy does not promise a fixed acknowledgement, remediation, or disclosure timeframe. Repeated status requests may not receive an immediate response while an investigation is active.
Recognition and good-faith research
With the reporter's permission, DigitalRow may acknowledge a helpful, validated report. We intend to handle research constructively when it follows this Policy, avoids harm, respects privacy, and complies with applicable law.
This statement is not an absolute legal safe harbour, a waiver of rights, or permission to breach a contract or third-party terms. If you are unsure whether an activity is permitted, contact us before proceeding.
Security contact and revisions
Until a dedicated security address is published, use the Contact Us page and begin the message with “Security vulnerability”. Do not send sensitive evidence in the initial message; we can coordinate an appropriate method if more information is needed.
We may update this Policy as EOM, our reporting process, or applicable requirements change. The date at the top identifies the latest version.