Security

Effective October 27, 2026. Your originals are irreplaceable, so we treat them that way. Here's how epk protects your work and your information, and how to report a problem.

Payments and cards

We never see, store or transmit card numbers. Cards are entered on Stripe's own payment pages and kept by Stripe, a PCI DSS Level 1 service provider. Our pages only send you to Stripe and receive a confirmation back. Every message from Stripe is verified with a signature before we act on it. Payments between media teams and their clients go directly between them; we never hold that money. Bank details a media team adds for its invoices are encrypted in our database.

Your files

• Originals are stored in a private bucket that has no public address. They're only reachable through short-lived signed links, created after we check that you're allowed to download, and every download is logged.
• Originals are never altered or recompressed.
• Every original is copied to a second company's storage soon after upload, and deletions wait 30 days so a mistake can be undone.
• Previews and web sizes are made without the camera's location data.

Accounts

• Passwords must be at least 12 characters and are stored as one-way hashes.
• Two-step sign-in with an authenticator app is available to everyone and required for our staff.
• Sign-in, password-protected links and other secrets are rate limited against guessing.
• Team roles control what each teammate can do. Only owners handle billing.

Infrastructure

• All traffic is encrypted with TLS, and browsers are told to always use HTTPS.
• Our pages restrict where scripts can load from, can't be embedded by other sites, and don't load advertising or tracking scripts.
• Servers hold no data and can be replaced at any time. Data lives in managed, encrypted storage and databases, backed up nightly to a second provider, with restores tested every quarter.
• Secrets are kept in encrypted environment settings, never in code. Dependencies are checked for known vulnerabilities on every change.
• Staff access to the admin tools requires two-step sign-in, is limited to people who need it, and every action is recorded. Staff can't read your private messages through the admin tools.

If something goes wrong

We contain it, find what was affected, fix it and tell the people affected. Where the law requires, we notify you within the required time (in Wisconsin, within 45 days) and notify regulators.

Reporting a vulnerability

Email [security@ email] with what you found and how to reproduce it. Please give us a reasonable time to fix it before telling others, don't access other people's data beyond what's needed to show the problem, and don't disrupt the service. We won't take legal action against good-faith research that follows these rules, and we'll credit you if you'd like. Our machine-readable contact is at /.well-known/security.txt.