Security & responsible disclosure

How we protect your data

• Sign-in is passwordless (magic links); we store no learner passwords.
• Customer credentials (SMTP, GoPhish, any API tokens) are yours, read-only, encrypted at rest, and never logged or shown in reports.
• Completion and campaign records are signed into a tamper-evident evidence chain you can verify yourself.
• Our own responses carry a strict Content-Security-Policy and the standard set of security headers.

Report a vulnerability

Email security@eliteaiempire.com. We follow a 90-day coordinated disclosure window and will keep you updated. Please do not run simulations or tests against systems you do not own.

Simulations are consent-first

We never send a phishing simulation to anyone without the company's recorded written consent and a warmed sending domain. Landing pages teach; they never shame or capture passwords.