Security & Compliance for
EPOS Manager and EPOS Connect
Data Protection and Information Security

Third-party audit: ISAE 3000(SOC 2) type 1

Third-party audit: Penetration testing

Our web-application (EPOS Manager) and desktop
application (EPOS Connect) are developed withinbest practices. These applications are designed withsecurity-by-design and privacy-by-design as theguiding principles. High-level Software department
adhere to the following standards and practices
through development:• ISO 27001 – Information Security standard• Data privacy practice - The General Data ProtectionRegulation (GDPR)• AICPA SOC 2 controls - SOC for Service
Organizations: Trust Services Criteria – Report onControls at a Service Organization Relevant toSecurity and Privacy• OWASP Top Ten standard

EPOS can provide an ISAE 3000 (SOC 2) type 1(September 2023) report which has EPOS Manager(EM) and EPOS Connect (EC) in scope. One of thebig 4 firms has audited EPOS high-level software
department in the controls concerning the trust
service criteria Security and Privacy. With thisreport/attestation we can provide assurance to ourcustomers that we follow best practices and meetcompliancy regulations.

Through IT risk assessment with architects
and management meetings, EPOS is performs
penetration-testing of EM and EC when appropriate
and feasible (latest performed 2023– Letter ofEngagement can be shared). The test is done as awhite-box test where source-code is available to thethird-party security tester. Total source-code review is
not performed by third-party.

By request the report can be shared with customers
under a non-disclosure agreement.

Data processing (incl. storage)

Regulations and laws

EPOS Manager collects personally identifiable
information (PII) data which is specified in the Data
Processing Agreement when signing up. The data
categories for PII: Name, Email address, IP address,
MAC address, Machine name. EM has integrated afeature(privacy-by-design) which allows the customers
to anonymize their data and deselect data processing.

EPOS application software is compliant with:• The General Data Protection Regulation: EPOS has
implemented the appropriate privacy and security
measurements.
• Digital Operational Resilience Act: As a vendor
to the European financial market, EPOS has
implemented security measurements to follow Digital
Operational Resilience Act obligations as an ICTvendor e.g., a Vulnerability Disclosure Program. We
can provide our SOC 2/third-party report so thatcustomers can perform a supply-chain assessment
and/or third-party risk assessment.

EPOS Connect as a standalone do not collect/process personally identifiable information, but only
log data for Device General information: Software,Products, Call activity statistics, Softphone, Host
information where products are used, Application logs,
Error logs of EPOS Connect used for the improvement
and optimization of the system and overall EPOS
Group A/S’s product family.

• Network and Information Security 2 (NIS 2)
Directive: As a vendor to the critical sectors, EPOS
has implemented security measurements to complywith NIS 2 obligations as an ICT vendor e.g., aVulnerability Disclosure Program. We can provide
our SOC 2/third-party report so that customers
can perform a supply-chain assessment and/or
third-party risk assessment.
Note: If required by the customer EPOS can investigate
the potential for compliance with other standards,
regulation or laws.

Diagram A

Overview of EPOS Managerand EPOS Connect
As mentioned earlier, EPOS Manager and EPOS
Connect only process PII in correlation together.
If EPOS Connect is used as a stand-alone, there
will be no collection of PII. Diagram A illustrates theinfrastructure and correlation between EPOS productcategories and applications. Diagram A illustrates
the infrastructure and relation between applications
and device.

For technical support and customer service,please contact EPOS here

EPOS Connect

EPOS Manager (Cloud or On-premise)

Desktop/Mobile App

Desktop App

Mobile App

Windows, Mac, Linux

Android and iOS

EPOS Audio Devices

EPOS Audio Devices

Frontend
Cloud API*Backend

Microsoft Azure

EPOS Video Devices*UC Management Partner

03.2024_1298366286

For more information about EPOS Connect andEPOS Manager, please visit the EPOS website hereEPOS Manager Web application