Account protection
The portal is designed with HTTPS, password hashing, session cookies, permission checks, authenticator MFA, account recovery controls and limited-time sessions. We protect uploaded files behind application permissions. No control eliminates all risk.
Sessions and trusted devices
Sessions have configurable server-enforced inactivity and maximum lifetime rules. If enabled for a user, a remembered MFA device can bypass a fresh authenticator challenge for up to 14 days after a valid password sign-in; device trust can be revoked by a password change or MFA reset.
Login activity
Where configured, successful and failed login attempts, IP addresses and device/browser details may be recorded for abuse detection, auditing and support. We do not record plain-text passwords in login history.
Attachments
Uploads are intended for authorised business users and may contain commercially sensitive information. Only upload information needed for the request, and contact us promptly if a file appears to have been sent to the wrong people.
Reporting security concerns
Report suspected account compromise, a security issue or a privacy incident to support@ekreongroup.com. Include a clear description and safe reproduction details, but do not attach real user data or access information. Please do not disrupt services, access data that is not yours or publish sensitive findings before they can be assessed. We will triage reports based on severity and available information.