Skip to content
Let`s talk

TRUST CENTER

Every claim here is one you can check without asking us.

Each claim names the artefact that proves it — a licence file, an install procedure, an export format, a repository. Where a fact is genuinely under review, the section is absent rather than hedged.

WHAT'S IN IT

01

What this first version covers — and what it does not.

THREE AREAS NOT COVERED HERE YET — ABSENCE IS DELIBERATE

THREE AREAS NOT COVERED HERE YET — ABSENCE IS DELIBERATE

01THIRD-PARTY SUB-PROCESSORSfor the company website are documented in the Privacy Policy; a self-hosted EpicStaff deployment is covered in the deployment section below.
02ACCESS-CONTROL & TENANCY SPECIFICSreturn in a later version once an in-progress fix is verified.
03OFFLINE-ENFORCEMENT BEHAVIOURreturns once the engineering read is confirmed.

Nothing here waits on a decision that changes the facts above; these three wait on work in flight, and we would rather say nothing than say something we would retract.

This first version covers what you can verify directly today: the licence and source, where the software runs, how EpicStaff connects out, the session and interaction and how to export it, our compliance-support posture, and the classification band the architecture is built for.

02

The licence, and what you may do with it.

EpicStaff is source-available under the PolyForm Perimeter 1.0.0 licence.

LICENCE TEXT & SOURCE github.com/EpicStaff/EpicStaff

A WORD WE DO NOT USEWe do not describe EpicStaff as open source, because it is not OSI-approved and the term would be inaccurate. Source-available is the precise description: you can read it, run it and change it for yourself. If your policy distinguishes the two — many do — this is the distinction, stated by us rather than discovered by you.

Read it, run it, and modify it for your own use. The restriction is commercial competition — you may not use it to provide a product that competes with EpicStaff. It is not a restriction on inspection. This matters for one specific moment in your evaluation: when your security reviewer asks how the enforcement layer behaves and the honest answer from most vendors is a description of their own product. Here the answer is a repository. The access-control and audit code is the code you run, and you can read it before you deploy it, during the pilot, and every time you upgrade.

03

Deployment and where processing happens.

There is no EpicStaff-operated control plane between you and the software: you run it, you hold it, and the legal jurisdiction that reaches your data is the one your deployment sits in.
How the platform connects out — and the one current exception — is set out in full in the network-connections section below.

EpicStaff is deployed and run in an environment you control, and the platform's own components do not require an outbound connection to EpicStaff-operated infrastructure to function.

That section is the authoritative answer to "what leaves my environment"; this one answers "whose infrastructure runs it" — ours is not in the path.

04

Network connections.

TWO KINDS, KEPT APART

TWO KINDS, KEPT APART

Platform-core featuresThe platform's model calls and its embeddings go to whatever endpoint you configure — including a local one. Two qualifiers, stated because your reviewer will find them anyway:
01THE DEFAULT IS CLOUD, NOT LOCALA local endpoint is a deliberate configuration for both the model and the embedder, not the out-of-box state.
02VOICE/REALTIME CURRENTLY REQUIRES A CLOUD PROVIDERNo local option exists yet. With egress blocked, voice/realtime does not function.
Operator-enabled toolsA tool reaches the internet only if its job needs it and you enabled it. Enabling none of the network tools leaves the platform's tool layer without outbound connections.

AIR-GAP BOTTOM LINELocal model inference, a locally-configured knowledge base, and local document and file workflows run fully offline; voice/realtime requires a cloud provider until a local option ships; every SaaS tool an operator enables is the operator's choice.

EpicStaff connects out only to the providers you configure keys for. Tools do what you tell them: a tool you build or enable that reaches the internet is your choice and your configuration.

Check it yourself: ask us for the per-component list — every component that can connect out, whether a local option exists, and the source that proves it. We'll share the current one.

05

Evidence and audit.

  • JSON
  • CSV
  • sessions
  • agent calls

EpicStaff persists a record of sessions and agent interactions — prompts, tool calls, and model responses — and that record can be exported as JSON or CSV for review in your own tooling. Producing the export does not require EpicStaff.

06

Compliance support for your audits.

  • Exportable session and interaction records

    evidence your auditors can check for themselves.

  • Access-control building blocks

    in the source you run — readable, not described.

  • Operational documentation

    how the system works, for your own SOC 2, ISO 27001 or BIO process.

STATED PLAINLYEpicStaff holds no security certifications of its own — no SOC 2 report, no ISO 27001 certificate — and this page is built so your auditors can verify what we do give without taking our word for it.

Compliance support for your audits: session and interaction record export, access controls, and documented procedures for your SOC 2 / ISO / BIO process. What your auditors get from EpicStaff is evidence they can check for themselves.

07

Built for classified and defence environments.

Architected to support deployment in environments handling information classified up to Departementaal Vertrouwelijk (the Dutch government's TBB-4 level).

DUTCH GOVERNMENT
Departementaal VertrouwelijkTBB-4

NEXT STEP

Start a conversation.

Tell the automated EpicStaff Assistant a little about the field you work in, the kind of data your teams handle, and the work you would like to optimise. That is the quickest way to find out what EpicStaff can do for you specifically.

Let’s talk