Security
It lists what each item is worth, who is carrying it and which building it sits in. This page sets out exactly how that data is protected, who can reach it, what is recorded and what happens when something goes wrong.
An asset register is a map of everything valuable your organization owns, and where each item currently sits. It is treated accordingly.
All traffic between your browser and Eze IT runs over TLS 1.3, with older protocol versions and weak cipher suites disabled rather than merely discouraged. Records, attachments and backups are encrypted at rest with AES 256. Encryption keys are held in a managed key service, separated from the data they protect, and rotated on an annual schedule as well as immediately on any personnel change that touches key access.
Every customer workspace is logically isolated, and that isolation is enforced at the data layer rather than in application code alone. Each query carries the workspace it belongs to, and a request that does not resolve to a single workspace is rejected before it reaches storage. There is no shared table that one customer can read another customer out of.
You choose your hosting region when the workspace is created: the United States, the European Union or the United Kingdom. Your records, attachments and backups stay in that region for their entire life. Enterprise customers can request a dedicated region where their data does not share infrastructure with other accounts at all.
Our own staff have no standing access to your workspace. An engineer who needs to investigate a support case raises a request with a specific reason, receives access limited to the affected area and expiring within hours, and every action taken during that window is written to a log you can request at any time. We do not sell customer data, we do not share it with advertisers, and we do not use it to train models.
In short
Most inventory data is lost through a shared login rather than an attack. Eze IT is built so nobody needs one.
Permission in Eze IT is a role plus a scope. The role decides what a person can do, from read only through technician and manager to full administration. The scope decides where they can do it: one site, a region, a department, or the whole organization. A technician responsible for two buildings sees those two buildings, and nothing about cost centers, purchase prices or headcount elsewhere.
Custom roles go further and control visibility field by field. Purchase price, supplier terms and depreciation class can be hidden from the people who move equipment around while remaining visible to finance, on the same asset record, without duplicating data into a second system.
Read only viewers are free and unlimited on every plan, which removes the last practical reason to share an account. Auditors and contractors can be granted read only access with an expiry date set at the point of invitation, so the access closes itself when the engagement ends rather than waiting for someone to remember.
Single sign on is available with any SAML 2.0 or OpenID Connect provider, including Microsoft Entra ID, Okta, Google Workspace and JumpCloud. With SCIM provisioning enabled, accounts are created, updated and deactivated from your directory, so somebody who leaves your organization on Friday cannot sign in on Monday. Where single sign on is not used, multi factor authentication can be enforced for every administrator, and API tokens are scoped, individually named and revocable without affecting anyone else.
In short
A number in a report is only worth anything if you can show where it came from. Eze IT keeps that evidence permanently.
Every change in Eze IT is written to an append only log. The entry records who made the change, exactly when, from which address and session, what the value was before, and what it became. That applies to asset edits, assignments, transfers, state changes and disposals, and equally to permission changes, role assignments, integration configuration and export activity.
The log cannot be edited or deleted by anyone, including your own administrators and our staff. There is no interface for altering history and no support request that can remove an entry, because the ability to quietly correct the record is precisely what an audit trail exists to prevent.
Because nothing is overwritten, Eze IT can reconstruct the register as it stood at any past moment. Run a report against last September and you get last September, including assets that have since been retired and values that have since changed. Every figure in that report links back to the records and the log entries that produced it, so a question from an auditor is answered by opening the number rather than by starting an investigation.
Change history is retained for seven years by default, which covers the statutory retention period in most jurisdictions our customers operate in, and can be extended on the Enterprise plan. The full log can be exported at any time in CSV or JSON, and auditors can be given read only access to it directly, with their own named account and an expiry date.
In short
Backups that have never been restored are a hope rather than a plan. Ours are tested on a schedule.
Eze IT takes an encrypted snapshot of every workspace hourly, and streams the transaction log continuously between snapshots. Together those allow point in time recovery to any minute within the last 35 days, so a recovery target is a moment you choose rather than the last time a nightly job happened to run.
Snapshots are stored in the same region as the workspace they belong to, encrypted with separately managed keys, and replicated across at least three physically separate availability zones within that region. They are never copied to another region without a written instruction from you, because doing so would quietly break the residency commitment you selected at setup.
Restores are tested quarterly against a live workspace copy rather than assumed to work, and the results are recorded. Our recovery objectives are a recovery point of five minutes and a recovery time of four hours for a full regional failure. Smaller incidents, such as a customer needing an accidental bulk edit reversed, are usually resolved in minutes using the change log rather than a restore at all.
If you close your account, your workspace becomes read only for thirty days so you can retrieve anything you still need. After that it is permanently deleted, including from backups, within a further thirty days, and we confirm the deletion in writing. A full export of records, change history and attachments is available on every plan at any time, without a support request, so you are never dependent on us to get your own data back.
In short
How we operate
Controls only hold if the way the product is built and run supports them. These are the working habits underneath.
Dependencies are scanned on every build and patched on a fixed schedule by severity. Independent penetration testing is carried out annually, and a summary report is available to customers under a mutual non disclosure agreement.
Every change is peer reviewed before it merges, automated tests run on each commit, and production access is separated from development access. Infrastructure is defined in code so a change can be reviewed and reversed like any other.
A documented response plan with named owners and defined severity levels. Affected customers are notified within 72 hours of a confirmed personal data breach, with a written summary and remediation plan to follow.
A current list of every sub-processor, what it does and where it operates, is provided on request and updated when it changes. Customers on annual agreements are notified 30 days before a new sub-processor is introduced.
Working through a security questionnaire or a data processing agreement? Send it to us and it comes back from the team that runs the platform, normally within three business days.
Review it properly
Hosting region, encryption, retention, access controls and the audit trail get answered on the call, with the person who can actually confirm them, rather than in an email thread a fortnight later.
Expires in
Limited time offer
We rebuilt your site for you. Claim it and we handle everything transfer, hosting, and your domain. Then update it anytime, just by asking AI.
Claim limited offer now