Security
Empower GME handles institutional accreditation data. Here's how we protect it.
Encryption
All traffic to and from Empower GME is encrypted in transit (TLS). The database is encrypted at rest by our hosting provider.
Tenant isolation
Each institution's data is scoped at the data-access layer, not just the interface — a user at one institution cannot query another institution's records, enforced by the same code path every screen uses. This isolation is covered by automated tests that run on every change to the codebase.
Access control
Role-based permissions (DIO, GME Director, Program Coordinator, Executive, Auditor) determine what each user can see and do. Every change in the system is attributed and logged.
Aggregate-data-first design
The core product operates on institutional and program-level metrics — not individual trainee records. Where individual-level data is supported (on our roadmap), it lives in a separate module with its own, stricter access controls and is disabled until an institution's specific legal and contractual requirements are in place. See our Data Processing stance.
Backups
Data is backed up regularly, and our restore process is tested — not just enabled and assumed to work.
Compliance roadmap
We are an early-stage product. A formal SOC 2 report is on our roadmap as we grow; until then, we're glad to answer specific security questions as part of your institution's review process.
Report a security issue
If you believe you've found a security issue, please tell us via our Contact page — we take reports seriously and will respond promptly.