ENG’s Commitment to Security, Privacy, and Compliance
ENG is committed to the highest standards of data protection, with safety as a top priority for customers and processes. Our Trust Center provides transparency into security controls, compliance posture, and operational practices aligned with industry-recognized frameworks, including SOC 2 Type II, ISO/IEC 27001, and ISO/IEC 27701.
Audit framework
Independent audit framework for how ENG manages and safeguards client data.
Security certification
Framework for an Information Security Management System focused on confidentiality, integrity, and availability.
Privacy certification
Extension of ISO 27001 for privacy and the responsible handling of personal and sensitive data.
ENG maintains a formal Information Security Management System (ISMS) structured around ISO/IEC 27001 and SOC 2 Type II Trust Services Criteria.
Security governance and risk management
Endpoint and network security
Continuous monitoring and logging
Identity and access management (IAM)
Secure software development lifecycle (SDLC)
Multi‑factor authentication enforced
Least privilege access model
Security awareness training for all employees
Annual penetration testing and vulnerability scanning
ENG is committed to protecting personal data and aligns its privacy practices with GDPR, ISO/IEC 27701, and SOC 2 Type II Privacy principles (where applicable)
Data minimization and purpose limitation
Consent and lawful processing mechanisms
Defined data retention schedules
Regular privacy risk assessments (PIAs/DPAs)
Formal risk assessment process using likelihood × impact
Risks reviewed and approved by leadership
Continuous monitoring of high‑risk areas
Security assessments for critical vendors
Contractual security and privacy requirements
Ongoing reassessments for high‑risk vendors
Data hosted with enterprise‑grade cloud providers
Encryption in transit (TLS 1.2+) and at rest (AES‑256)
Logical tenant separation
Role‑based access control (RBAC)
Logging and monitoring of privileged access
Quarterly access reviews
Documented BCP and DR plans
Regular testing and tabletop exercises
Defined RTO/RPO targets
Formal incident response plan
24/7 monitoring and triage
Customer notification procedures aligned with contractual and regulatory requirements
Information Security Policy
Access Control Policy
Privacy & Data Protection Policy
Incident Response Policy
Vendor Risk Management Policy
