Security and Privacy

Our client portal, internal systems, and integrations run on Supabase, a Postgres database with encryption at rest and TLS in transit, hosted on Vercel. Primary data processing happens in US regions. Access follows the principle of least privilege, with role-based controls for our team and audit logging on sensitive operations.

Every Mpower team member operates as an independent contractor based in the Philippines, Colombia, Nicaragua, or South Africa. Every contractor signs a non-disclosure agreement before engagement. We verify government-issued identification at hire and check professional references directly. For sensitive roles, we conduct in-country background screening through local partners.

Workflows we operate on behalf of healthcare clients through our IntelePeer partnership run on IntelePeer's HIPAA-compliant infrastructure and inherit its compliance posture. If your engagement involves protected health information, we will scope it through that stack.

We are happy to sign a mutual NDA before any discovery conversation. Non-disclosure and non-solicitation terms are built into every contractor agreement, protecting both your information and the working relationship we build for you.

Our active subprocessors are Supabase for database hosting, Vercel for web hosting, Google Workspace for email and files, and LeadConnector for CRM and booking. Each carries its own SOC 2 attestation or equivalent.

If your procurement team needs a security questionnaire completed, reach us at myron@mpowersourcing.com. We respond within two business days.

If you believe you have found a security issue affecting Mpower Sourcing or our clients, email security@mpowersourcing.com (or myron@mpowersourcing.com if that alias is not yet active) with a description and reproduction steps. We will acknowledge within one business day.