EVASUITE
SECURITY OVERVIEW

How Eva is kept safe.

The short version for your security team. Eva Suite is built and run by THAT MAC CHAP in Melbourne. For the long version, or to report a problem, email help@thatmacchap.com with "Security" in the subject.

Signing in

  • People sign in with the work account they already have, through Microsoft Entra ID or Google Workspace. Your own conditional access and multi-factor rules apply.
  • The few accounts that use an email and password must also use an authenticator app.
  • Sign-in attempts are rate limited per account and per network, and sessions expire.

Who sees what

  • Every page and every record is scoped to a company. Your administrators see your Macs and nothing from any other company.
  • THAT MAC CHAP engineers see the companies they look after. Changes are logged with who, when and why.
  • Shared, fleet-wide settings are never shown to company administrators.

In transit

  • Everything is served over TLS with current certificates and HTTP Strict Transport Security. Older TLS versions are refused.
  • Each Mac's agent authenticates with its own token. Eva Protect's web filter fails open: if Eva is ever unreachable, Macs keep resolving normally and nobody is cut off.

Remote support

  • A remote session starts only when the person on the Mac says yes, or from a support ticket with a banner shown on the Mac for the whole session.
  • The Mac opens an outbound tunnel to Eva's relay; nothing listens on the Mac and no inbound port is opened on your network.
  • Every session is recorded as an event: who connected, when and for how long.

Data and backups

  • Eva runs in DigitalOcean's Sydney region. Databases are backed up nightly, encrypted, and kept for a short period.
  • Mail stays in your own Microsoft 365 or Google Workspace tenant. Eva reads it through the provider's APIs under permissions you grant and can withdraw.
  • A plain-English note on what Eva holds is on the privacy page.

Eva Protect

  • Threat lists from several independent sources, refreshed daily, with a never-block list for shared platforms so a bad entry can never take down Google, Microsoft or Apple services.
  • Blocked lookups show a page that says what happened and routes a request to your approver. Watch and Warn are report-only.
  • Detections from the Endpoint Security agent are handled as cases with an owner and a status.

Reporting a problem

If you find a security problem in Eva, email help@thatmacchap.com with "Security" in the subject. We acknowledge within one business day, keep you informed while we fix it, and credit you if you would like. Please do not test against companies' live Macs or mailboxes; ask us for a test tenant instead.

Last updated 9 November 2026.