Your own system
Every company gets its own EPMS: its own database, its own file storage and its own web address. Your data is never mixed with another company’s.
Security
Owner money and guest data deserve better than a password.
You are trusted with other people’s money and personal information. EPMS is built so that trust is earned by design, not by promise.
Encrypted everywhere
Everything travels over HTTPS and is encrypted at rest. Payment processor keys, bank connections, and stored card and bank account numbers are encrypted a second time, with keys held apart from the data.
Two-step login
A code from an authenticator app on top of the password, with one-use recovery codes. A Super Admin can require it for every Super Admin and Admin.
Sign-in protection
Repeated wrong passwords lock the sign-in for 15 minutes, and a session left idle for 12 hours signs itself out. Every sign-in, success or failure, is recorded.
Roles and permissions
Each person sees and changes only what their role allows, down to individual screens. Setup is limited to Super Admins.
Audit trail
Changes to reservation details, units, nightly rates and journal entries are recorded with who made them and when. Revealing a stored bank or card number is itself logged.
Nightly backups, tested nightly
Every database is copied every night and restored into a scratch copy to prove it works before it is kept. Daily copies are kept 90 days and monthly copies 7 years.
Watched around the clock
Every system is checked every five minutes: is it answering, are its scheduled jobs running, are emails failing, did last night’s backup work. Problems alert us by email.
Cards handled with care
Payment links and automatic payments take the card on your payment processor’s own form (Stripe or Yapstone). A card kept on a contact’s record is encrypted, and only a Super Admin can reveal it — with their password, and the reveal logged.
Built on Cloudflare
EPMS runs on Cloudflare’s global network, behind its DDoS protection, with no servers of our own exposed to the internet.
Our program
Written down, and followed.
EPMS keeps a written Information Security Policy covering access control, encryption, secure development, vendor review, incident response and data retention, reviewed every year. Customers can request a copy under a confidentiality agreement.
Your data, your choice
We never sell it.
Your company owns its data. EPMS does not sell it or use it for advertising, and a Super Admin can export your contacts, owners, units, reservations, open payables and chart of accounts at any time. Read the Privacy Policy.
Found a security issue?
Please tell us at info@escpms.com. We will acknowledge your report promptly and keep you informed while we fix it.