Security
Empower GME handles institutional accreditation data. Here's how we protect it.
Encryption
All traffic to and from Empower GME is encrypted in transit (TLS). The database is encrypted at rest by our hosting provider.
Tenant isolation
Each institution's data is scoped at the data-access layer, not just the interface — a user at one institution cannot query another institution's records, enforced by the same code path every screen uses. This isolation is covered by automated tests that run on every change to the codebase.
Access control
Role-based permissions (DIO, GME Director, Program Coordinator, Executive, Auditor) determine what each user can see and do — an Auditor account, for example, can view but never edit. Sensitive actions are attributed to the user who performed them and recorded in an audit trail.
Aggregate-data-first design
The core product operates on institutional and program-level metrics — not individual trainee records. Where individual-level data is supported (on our roadmap), it lives in a separate module with its own, stricter access controls and is disabled until an institution's specific legal and contractual requirements are in place. See our Data Processing stance.
Backups
Data is backed up automatically by our hosting provider. We maintain a documented disaster-recovery plan.
What we're actively building
We are an early-stage product, and we'd rather say so plainly than overstate where we are. In progress: a formal SOC 2 report, a regular and logged disaster-recovery restore-test cadence, and broader audit-trail coverage across the system. We're glad to answer specific security questions as part of your institution's review process in the meantime.
Report a security issue
If you believe you've found a security issue, please tell us via our Contact page — we take reports seriously and will respond promptly.