Privacy Policy

1. Introduction

ECOBPM Technologies ("ECOBPM," "we," "our," or "us") operates the EcoBPM CMMS platform, accessible at westonbpm.com (the "System"). This Privacy Policy explains how we collect, use, store, protect, and disclose information when you access or use our System.

EcoBPM CMMS is a cloud-hosted Business Process Management platform used by authorized personnel of Weston Solutions, Inc. to manage service orders under U.S. government contracts. Access to the System is restricted to authorized users only. This is not a public-facing consumer platform.

By accessing or using the System, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy.

2. Scope and Applicability

This Privacy Policy applies to:

• All authorized users of EcoBPM CMMS (westonbpm.com)
• All data collected, processed, or stored through the System
• All devices and sessions used to access the System

This Policy does not apply to third-party websites, services, or platforms that may be linked from the System. ECOBPM Technologies is not responsible for the privacy practices of third parties.

3. Information We Collect

3.1 Account and Identity Information

When a user account is created by an authorized administrator, we collect and store:

• Full name
• Business email address
• Job title and role
• Organizational affiliation (e.g., Weston Solutions, Inc.)
• Role-based access permissions assigned by the administrator

ECOBPM Technologies does not offer self-registration. All accounts are provisioned by authorized system administrators.

3.2 Authentication and Session Information

To secure access to the System, we collect and log:

• Login timestamps (date, time, timezone)
• Logout timestamps
• Failed login attempts (count and timestamp)
• IP address at time of login
• Device type and browser user agent string
• Session identifiers
• Multi-factor authentication (MFA) events

3.3 Activity and Audit Data

To maintain system security and satisfy federal compliance requirements, we collect:

• Actions performed within the System (creating, editing, viewing, or deleting records)
• Field-level changes to Work Orders and Service Orders — including previous and updated values, the user who made the change, and the timestamp
• Actions performed in administrative modules (Settings, User Management, CLIN Management, Contract Management)
• Documents and files uploaded, viewed, or downloaded

3.4 Technical and Infrastructure Data

We automatically collect technical data necessary for system operation and security monitoring:

• Server request logs (via AWS Elastic Load Balancer)
• Application error logs
• AWS CloudTrail logs — all infrastructure-level API calls and console actions
• AWS GuardDuty findings — automated threat detection data
• AWS CloudWatch metrics — system performance and security metrics

3.5 Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)

EcoBPM CMMS processes operational data related to U.S. government contracts, which may include Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) as defined under DFARS 252.204-7012. This data is provided by and belongs to Weston Solutions, Inc. and is processed solely in connection with authorized contract activities.

We do not use FCI or CUI for any purpose other than providing the contracted services.

4. How We Use Your Information

Purpose	Legal Basis
Providing and operating the EcoBPM CMMS platform	Performance of authorized subcontract
Authenticating users and securing system access	Security obligation — NIST SP 800-171, DFARS 252.204-7012
Maintaining audit trails for compliance and accountability	Federal regulatory requirement
Detecting, investigating, and responding to security incidents	Security obligation — DFARS 252.204-7012
Monitoring system performance and availability	Operational necessity
Complying with federal laws, regulations, and contract requirements	Legal obligation
Investigating policy violations or unauthorized access	Security and compliance

We do not:

• Sell, rent, or transfer your personal information to third parties for commercial purposes
• Use your information for advertising or marketing
• Use your information for any purpose unrelated to the services provided under the authorized subcontract

5. How We Store and Protect Your Information

5.1 Infrastructure

All data is stored within Amazon Web Services (AWS) infrastructure in the United States (us-east-1, N. Virginia region). AWS is a FedRAMP-authorized cloud service provider.

5.2 Encryption

• Data at rest: All database data is encrypted using AWS Key Management Service (KMS) with customer-managed keys. All storage (RDS SQL Server, S3) is encrypted at rest.
• Data in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher via HTTPS. HTTP connections are automatically redirected to HTTPS.

5.3 Access Controls

• Access to the System requires individual named accounts — no shared credentials
• Multi-factor authentication (MFA) is required for all users
• Role-based access control (RBAC) limits each user to only the data and functions required for their role
• AWS infrastructure access is restricted to authorized ECOBPM Technologies personnel with MFA-protected IAM accounts

5.4 Security Monitoring

We continuously monitor the System using:

• AWS GuardDuty — automated threat detection
• AWS CloudTrail — full audit trail of all infrastructure actions
• AWS CloudWatch — real-time security and performance monitoring
• AWS Config — configuration change tracking
• AWS WAF — web application firewall blocking known attack patterns
• AWS Inspector — continuous vulnerability scanning

5.5 Compliance

EcoBPM CMMS is operated in compliance with:

• NIST SP 800-171 Rev 2 — Protecting Controlled Unclassified Information
• DFARS 252.204-7012 — Safeguarding Covered Defense Information
• CMMC Level 2 (Self Assessment) framework

6. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

ECOBPM Technologies
Privacy and Compliance
801 International Pkwy, 5th Floor
Lake Mary, FL 32746
United States

Email: privacy@ecobpm.com
System: westonbpm.com

For security incidents or to report a concern, contact the infrastructure team directly per the procedures in your system onboarding documentation.