Security

Multi-tenant isolation, fail-closed, no “trust the application code”.

Tenant isolation

• Every customer row carries a tenant identifier; reads and writes refuse the request when the tenant context is empty.
• The isolation is enforced at the data layer, not in the application code. There is no privileged bypass on the production path.
• Operational scripts that need broad access run under a separate role and log to a parallel audit stream.

Fail-closed by design

• Authorisation defaults to deny.
• Every handler resolves a tenant from the authenticated principal or refuses.
• No “sysadmin” flag is honoured in production code.

Audit trail

• Every calculation, export, and read writes a structured record — principal, calculator class, engine version, input hash, output hash.
• The audit log is append-only and immutable from the application’s perspective.

Data residency

• EU customer data is targeted to an EU cloud region for the production deployment (planned).
• Test and dev environments run against synthetic and public-regulator data only; no customer data is processed there.
• Full sub-processor list lives on /trust and in the downloadable Compliance Evidence Pack.

Encryption

• TLS 1.2+ in transit; HSTS preload on this site.
• Persistent storage and object stores encrypted at rest with customer-managed keys.
• Bunker delivery note PDFs stored under per-tenant prefix isolation and key-grant scoping.

What we do not claim in v1

• SOC 2 Type II is a Phase 4 commitment, not a v1 claim. No badge until the report exists.
• ISO 27001 sits behind SOC 2 in the planning order.
• If your procurement team needs SOC 2 before pilot signature, email us — we will be honest about the timeline.

GDPR posture

• We process fleet operational data and emission factors, not consumer personal data.
• Data subjects are corporate employees with login accounts (admin, analyst, viewer roles).
• We process under legitimate-interest and contract-performance bases, do not sell data, and accept DPA terms on request.