Security

You are putting quality forms, review files, and related records here, and some of those records name individual people. This page says what happens to them.

Every statement below is a control in force today on inEspect. The last section exists because a page that lists only strengths tells a reader nothing about how carefully the rest was written.

Who we are

Easy Audit is an Egyptian company in digital solutions. It builds and operates software products — including inEspect — for organizations that need durable digital records and workflows.

inEspect is operated by Easy Audit. We are a small team, and this page is written to be checked rather than to reassure.

Keeping your data apart from everyone else's

Every record belongs to one company (tenant) and every request is scoped to the membership making it. A user of one organization cannot reach another's data by guessing an address. Checks run on the server for every request; hiding a link in the UI is not the control.

Who can see what

Permissions are held per role and checked server-side. Your organization decides who is invited or approved, what role and department they hold, and what they may do. Deactivating a member bumps session version so they are signed out everywhere immediately rather than at the end of their session.

Platform administrators use a separate global console and have no company membership.

Signing in

• Passwords are stored as Argon2 hashes and never in a form anybody can reverse. We never send a password by email — only one-time setup or reset codes.
• Password policy: minimum 10 characters with upper, lower, digit, and special character.
• Two-factor authentication (TOTP + hashed backup codes) is available to company users. Platform administrators are required to use MFA in production before using the console.
• Sign-in locks after 5 failed attempts for 30 minutes. Failed attempts for unknown emails still do comparable work so response timing is not a user oracle.
• Sessions expire after twelve idle hours. Force-logout uses `session_version`.

Your files

Uploaded evidence and review files are intended for private object storage (Amazon S3 as configured). Access is mediated by the application and tenant permissions — there is no public browse address for company files. We do not claim content-sniffing or signed-URL detail beyond what is shipped in the running deploy.

Encryption

Production traffic uses HTTPS; TLS terminates at Nginx. When `SITE_URL` is https, secure cookies and HSTS are enabled. The database (Neon PostgreSQL) and object storage are encrypted at rest by their providers. MFA secrets are encrypted with a separate application key (Fernet).

What we record

Security-relevant actions are written to an append-only audit log: sign-in success and failure, lockouts, MFA events, password/setup codes, and platform operations. Platform staff can review platform events; company-scoped product events follow the permissions of the running product.

People and company admins cannot edit or delete individual audit rows. A company manager may clear older events from the Audit log UI to free plan storage (suggested window: 90 days), and that action is itself logged.

Backups

Managed database hosting (Neon) provides provider-side durability. Application-level nightly dump schedules, customer self-serve archive restore, and measured recovery objectives are not published as committed product features until they are rehearsed and documented for this stack. Deleting a live record does not instantly erase every backup copy a provider may still hold for a short window.

Where your data is

Application data lives in Neon PostgreSQL. Files use Amazon S3 (or the configured private storage) in the regions you operate. Outgoing mail is sent via the SMTP provider configured for noreply@inespect.com (Namecheap Private Email in the usual deploy). Payments are handled by Paddle as merchant of record when live checkout is enabled; Paymob may be added later. We never store card or bank details in inEspect.

The fuller list of who touches data is on Subprocessors and in the Privacy Policy.

How we build it

inEspect is a Django application with automated tests covering authentication, tenancy, and security-sensitive behaviour. We do not quote Easy Audit's test counts or CI numbers as if they applied here. Dependencies and secrets hygiene follow the project security baseline in `SECURITY.md`.

If something goes wrong

We have a published incident / breach notice commitment. If a breach affects your company data we notify the company contacts we have on file without undue delay, with the facts we know and the steps we are taking, so your own obligations can start. Where the law requires us to notify a supervisory authority, we will.

Your rights

Signed-in users can download a personal JSON export and submit a deletion request from Privacy tools. We review deletion requests; they do not wipe data instantly. If the data belongs to a customer's workspace, that organization's administrators are the first contact for records they control.

What we have not done

A page that lists only strengths tells you nothing about how carefully the rest was written. These are the gaps:

• We hold no ISO 27001 or SOC 2 certification, and this page should not be read as claiming one.
• We have not published an external penetration-test report for inEspect.
• We do not claim continuous intrusion detection or uptime monitoring as a shipped product control.
• We do not quote a measured recovery time objective until a full restore has been rehearsed and timed for this stack.
• Production access is held by a small operator team; single-person operational risk is real for a product of this size and we do not pretend otherwise.
• Egypt's data protection licensing for cross-border processing is being handled with counsel; we do not claim licences we do not yet hold.

If any of these matters to your decision, ask us at help@inespect.com. We will tell you where it actually stands rather than when we hope it will change.

Last reviewed September 2026. If you find something on this page that is not true, tell us and we will correct it.