Security

1. Manuscript confidentiality

Uploaded manuscripts are treated as confidential assessment material. They are not intended for public distribution or publication by EAIPAM.

Manuscript access should be restricted to the submitting user and authorised administrators who require access for a defined operational purpose.

EAIPAM will not use uploaded manuscripts to train general-purpose artificial- intelligence models without explicit permission from an authorised user.

2. Encryption during transmission

Communication between the user's browser and EAIPAM should be protected using HTTPS and current transport-encryption standards.

Users should avoid submitting manuscripts or account information through an insecure or untrusted network.

3. Encryption and protection at rest

Manuscript files, extracted content, reports and account records should be stored using access-controlled infrastructure.

Encryption at rest, storage isolation and secure provider configuration should be enabled where supported by the relevant hosting, database and file-storage providers.

4. Role-based access

Administrative access should be granted according to job responsibility and operational need.

Access levels may include:

• Customer access to their own submissions and reports.
• Assessment access for authorised editorial administrators.
• Technical access for restricted support and system maintenance.
• Elevated administrative access for designated platform operators.

Administrative privileges should be reviewed periodically and removed when no longer required.

5. Administrator access to manuscripts

Authorised administrators may access a manuscript only when reasonably necessary for:

• Performing or reviewing an assessment.
• Confirming, revising or excluding findings.
• Generating or correcting a report.
• Responding to an authorised support request.
• Investigating a security or acceptable-use concern.
• Complying with a valid legal requirement.

Administrative access must not be used to publish, distribute or exploit manuscript content.

6. Account authentication

Users are responsible for protecting their account credentials and should use a unique, strong password.

EAIPAM should implement:

• Secure authentication through a trusted identity provider.
• Password-reset verification.
• Session expiration and account sign-out controls.
• Protection against repeated unauthorised login attempts.
• Stronger authentication for administrator accounts.

Users should notify EAIPAM promptly if they suspect unauthorised access.

7. Activity logging and monitoring

EAIPAM may record relevant activities to support security, auditability and troubleshooting.

Logged activities may include:

• Login and authentication events.
• Manuscript submission and deletion events.
• Assessment-job activity.
• Report generation and access.
• Administrative review actions.
• Account and permission changes.
• Security errors and suspicious activity.

Logs should not contain complete manuscript content unless technically necessary for a documented and authorised purpose.

8. Secure development and change control

Changes to EAIPAM should be reviewed before deployment, particularly where they affect:

• Authentication or account access.
• Manuscript storage or deletion.
• Administrative permissions.
• Payment processing.
• Assessment or report data.
• Third-party integrations.

Production secrets, service keys and administrator credentials should not be placed in public source-code repositories.

9. Vulnerability management

EAIPAM should maintain a process for identifying and addressing vulnerabilities in:

• Application code.
• Software dependencies.
• Hosting and deployment settings.
• Database and file-storage permissions.
• Authentication configuration.
• Third-party integrations.

Critical security issues should be prioritised according to their potential impact on manuscripts, user accounts and platform availability.

10. Backups and service recovery

EAIPAM may maintain restricted backup copies to support disaster recovery and service continuity.

Backups should:

• Be protected against unauthorised access.
• Follow a documented retention cycle.
• Be used only for authorised recovery or investigation.
• Expire according to the published retention process.

Further information is provided in the Data-Retention Policy.

11. Manuscript deletion

Manuscripts should be deleted from active storage after the selected retention period or following an eligible verified deletion request.

Deletion may include:

• Original uploaded files.
• Converted processing copies.
• Extracted manuscript text.
• Extracted references, citations and claims.
• Associated reports where deletion has been requested and is permitted.

Limited transaction, consent, audit or security records may be retained separately where required or permitted.

12. Third-party service providers

EAIPAM may rely on third-party providers for infrastructure, authentication, storage, email, payments, scholarly-data access, monitoring and defined analytical functions.

Providers should be assessed for:

• Access-control capabilities.
• Encryption and storage security.
• Logging and monitoring.
• Backup and deletion controls.
• Incident-notification procedures.
• Confidentiality and processing restrictions.

Actual provider names and processing purposes will be disclosed in the Privacy Policy.

13. Security incidents

EAIPAM will maintain a process for responding to suspected security incidents.

The response process should include:

• Identification and initial assessment.
• Containment of affected systems.
• Protection of manuscripts and accounts.
• Investigation of relevant logs and records.
• Correction of the underlying vulnerability.
• Documentation of the incident and response.
• Notification where required by applicable law.

14. User security responsibilities

Users also contribute to the security of the platform.

Users should:

• Use a strong and unique password.
• Keep account credentials confidential.
• Sign out from shared devices.
• Keep their browser and operating system updated.
• Avoid uploading files from untrusted sources.
• Report suspected unauthorised access promptly.
• Verify that they are using the legitimate EAIPAM website before entering credentials.

15. Reporting a security concern

Users and security researchers may report suspected vulnerabilities, unauthorised access or manuscript- security concerns.

Reports should include:

• A clear description of the issue.
• The affected page, account or service.
• Steps needed to reproduce the issue, where appropriate.
• Relevant screenshots or error information.
• Contact information for follow-up.

Security researchers must not access, download, modify or disclose another user's manuscript or personal information.

16. No absolute security guarantee

No internet-based service, database, storage system or transmission method can guarantee complete security.

EAIPAM will use reasonable technical and organisational measures designed to reduce risk, but it cannot guarantee that every security incident, unauthorised access attempt, data loss or service interruption will be prevented.

This statement does not limit any security obligation or user right that cannot lawfully be excluded.

17. Changes to security practices

EAIPAM may update its security practices as the platform, infrastructure, service providers and relevant threats change.

Material changes affecting manuscript processing, user rights or published security commitments will be reflected on this page or in another appropriate notice.

18. Contact information