Security
Built for organisations that get audited.
EcoAttest holds field evidence, beneficiary information and the numbers that end up in corporate ESG disclosures. The controls below are implemented in the product, not aspirations on a roadmap.
Tenant isolation
Isolation enforced at multiple layers
Every organisation's data is separated by three independent mechanisms. A mistake in one is caught by the next — which is the point of having more than one.
- Layer 1
Request-level scope
Every request is bound to exactly one organisation for its whole lifetime, derived from the authenticated session rather than anything the caller sends.
- Layer 2
Data access isolation
Queries are constructed through a layer that applies the organisation filter automatically, so reaching another tenant's data is not something a developer can forget to prevent.
- Layer 3
Database-enforced backstop
The database independently refuses rows belonging to another organisation, using row-level security policies. The application connects with a restricted role that cannot bypass them.
Cross-organisation access has exactly one path
A single, deliberate platform-administrator route exists for support. It is permission-gated, time-limited and audited on every use — and it is the only way data crosses an organisation boundary.
Authentication
Proving who is asking
- Passwords hashed with Argon2id and never recoverable
- Short-lived access tokens with rotating refresh tokens
- Token reuse detection revokes the whole session chain
- Time-based one-time password (TOTP) multi-factor authentication
- Single-use recovery codes for lost authenticators
- Self-service password reset with single-use, expiring links
Authorisation
Deciding what they may do
Permission to see a project and permission to approve evidence are different things, and the platform treats them that way.
- Role-based access control across every endpoint
- Granular permissions rather than broad admin roles
- Separation of duties enforced in the domain, not the query
- Organisations cannot grant themselves platform privileges
- Scoped API keys that can never exceed their issuer's rights
- Immediate revocation of keys and sessions
Data protection
How data is held
Evidence in private object storage
Photographs and generated documents are never stored in the database and never publicly readable. Access is by short-lived signed URLs issued to an authorised session.
Encrypted credentials
Sensitive integration credentials and authenticator secrets are encrypted at rest, and are never returned in full to any client.
Encrypted in transit
All traffic is served over TLS.
Append-only audit trail
Every mutation records the actor, the organisation, the entity, the before and after state, and the source address. Audit records are written, never edited.
Rate limiting on public endpoints
Anonymous endpoints are rate limited per client, and public submissions are validated against strict bounded schemas.
Verifiable documents
Reports shared outside the platform carry a code resolving to a verification page, so a recipient can confirm a document is genuine and current.
Honest limits
What we do not claim.
Security pages are usually a list of badges. Here is the part most of them leave out.
We hold no third-party security certification today. When we complete one, it will be named here with its scope and date — not implied by a logo.
We publish no uptime figure we do not measure. A future status page will report availability we actually record.
Penetration testing by an independent firm is planned, not completed. We will say when that changes.
Send us your security questionnaire.
We would rather answer procurement's questions early than discover them late.