Security and how we protect your data

What we will never ask for

For the check and for your account we do not ask for:

• your tax number (ΑΦΜ) or social security number (ΑΜΚΑ)
• TAXISnet or gov.gr codes
• your IBAN or other bank account details
• card details or money

The check does not ask about health, disability or pregnancy.

We will never ask you by e-mail for your tax number, social security number or TAXISnet codes. If you get such an e-mail that says it is from us, it is not ours: do not reply and do not click its links.

We do not send text messages (SMS) and we do not phone you.

Where your answers go

Without an account

The check needs no account. Your answers stay in your device's browser and expire automatically 24 hours after your last change. They reach our server only if you ask to sign in to save them.

With an account

If you sign in, your answers are saved to your account, so you find them on every device. The application server and the database are in a Hetzner data centre in Germany (EU). If an answer about health, disability or pregnancy is sent, our database refuses to store it.

Who can see them

Only named, authorised people can enter the administration area, with an extra identity check. An administrator sees a citizen's data only for a specific request and for a limited time. Your data are not sold.

To run the site we use outside providers, such as Hetzner, Cloudflare and Google. The Privacy Policy explains who they are and what each one does.

How to delete them

Without an account: press "Delete answers from this device" on the check page, or clear the site's data in your browser settings.

With an account: from your account page you can download your data, clear your answers or delete your account yourself. Deletion needs a sign-in within the last 10 minutes, so nobody else can do it from your device. Your rights come from the GDPR; the Privacy Policy explains them.

How to tell myepidoma from benefit scams

Fake text messages and e-mails promise benefits or money in order to get your codes or card details. A few simple rules:

• Our site is myepidoma.gr. Before you type anything, check the address in your browser's address bar.
• We are not gov.gr, ΟΠΕΚΑ, e-ΕΦΚΑ or any other public body. You apply for a benefit only with the body responsible for it.
• For public services, type the address gov.gr into your browser yourself instead of clicking links in messages.
• If a message says it comes from a public body, contact that body using the details on its official website.
• If you are not sure about a message that says it is from us, write to us.

How we protect the site

This part is more technical. We describe the kinds of measures, not details that would help someone get around them.

Encrypted connection

Every page opens only over an encrypted connection (HTTPS, TLS 1.2 or 1.3). The connection stays encrypted from our protection network to our server too. Your browser is told to always use HTTPS for myepidoma.gr. The site's certificate renews automatically. Only the certificate authorities we have named may issue a certificate for our domain. The site's name is protected with DNSSEC.

SSL Labs: grade A+ for the connection's encryption (test of 23 October 2026). Run the test yourself

Protection against attacks and automated programs

Traffic to the site passes through Cloudflare's network, which filters denial-of-service (DDoS) attacks, malicious requests and automated programs. Our server accepts traffic only through that network. The number of requests is limited at more than one layer.

On forms (sign-in, contact, suggestions) we use Cloudflare Turnstile to tell people from automated programs, without picture puzzles. It sets no tracking cookie.

Protection inside your browser

The site gives your browser strict security rules (a Content Security Policy): only code that carries a unique value, different on every page load, may run. Our pages cannot be opened inside other websites, and they do not ask for your camera, microphone or location.

Public pages load no analytics, advertising or tracking programs and set no cookies. We use cookies only when you sign in, for your sign-in and account security (see the Cookie Policy).

Signing in without a password

We use no passwords. You sign in with your Google account or with a link we e-mail you, valid for 10 minutes. So we hold no passwords that could leak.

Administrator access

For every action in the administration area, the server checks that the administrator is allowed to do it and writes it to a log. If anyone tampers with the log, it shows. Each entry is kept 12 months.

Servers, database and backups

The database cannot be reached from the internet. Each part of the application runs with the least privileges it needs. The application's passwords and keys are not stored in its code. Citizens' personal data are not copied to development or test systems.

Every night we keep an encrypted backup of the database away from the server.

Automated checks and updates

Before each release, automated tools check our code, the libraries we use, the application package and the live site for known vulnerabilities and for secrets left in code. Libraries are monitored for security updates. For example, in October 2026 the Node.js and Next.js security updates were applied 1 to 2 days after their release.

The site is monitored automatically, with alerts for attacks and outages.

Protection against fake e-mails in our name

Our e-mail is protected against spoofing (SPF, DKIM, DMARC with a reject policy, MTA-STS). E-mail services that check these rules reject messages that falsely name myepidoma.gr as the sender.

What we cannot promise

No system on the internet is perfectly secure. The measures we describe reduce the risk; they do not remove it.

This page describes how myepidoma works today; it is not a guarantee and not a third-party certification. We hold no security certification and no external penetration test has been done. We describe what we do here so you can judge it yourself.

Which data we process, why and for how long is set by the Privacy Policy. If a personal-data breach happens, we act as the GDPR requires and as the Privacy Policy describes (section 13).

Found a security issue?

If you find something that looks like a security weakness, write to contact@myepidoma.gr with the subject "Security", in Greek or English. Describe what you saw, on which page and how to reproduce it. We will confirm receipt within 7 days.

Please:

• do not try to enter accounts or view other people's data; if you see personal data by accident, stop, do not keep it, and tell us what you saw
• do not run tests that load the service (for example many requests), and do not test third-party services we use
• do not publish the problem before we fix it

The Terms of Use (section 4) do not allow security testing of the platform. We offer no monetary reward. If you wish, we will credit you by name on this page. The security contact is also in our security.txt file.

For illegal content, not a security issue, use the Report illegal content form.

Who is responsible

Change log

• 23 October 2026: First publication of this page.