Security
Security built for client project data
Consultancies use EcoSphere Intelligence to hold their clients' documents, site data and assessment records. This page explains how that data is hosted, separated and protected today.
Where your data lives
Hosted by AWS in the United Kingdom
Production workspace data, the PostgreSQL database and uploaded files are hosted by Amazon Web Services in the United Kingdom. The sub-processor register lists every country where our providers may process data.
Cloudflare at the edge
The web application is delivered through Cloudflare's network over HTTPS.
Published sub-processors
Every third party that processes personal data for us, including our AI model providers, is named in the public sub-processor register, with what it processes, where, and a dated change history.
Read the sub-processor register
How workspaces are kept apart
Row-level security
Each customer's records are separated in the database with PostgreSQL row-level security, enforced under a database role that cannot bypass it and checked on every deployment.
Checked in the application too
Every request is scoped to a workspace, and people who are not members of a workspace are refused.
Roles
Owner, admin, member, viewer and guest roles control what each person can see and change.
Encryption
At rest
The database and file storage are encrypted with AWS KMS keys, and the database key rotates automatically.
In transit
All connections use HTTPS, enforced with HSTS. File storage refuses unencrypted connections and blocks public access.
Credentials
Stored integration secrets are encrypted at field level. Application secrets are held in AWS Secrets Manager.
Sign-in and access
Your identity provider
Workspaces can use single sign-on with Microsoft Entra ID, Okta or Google (OIDC), so your own MFA and joiner-leaver policies apply.
Short sessions
Sign-in sessions are short-lived and refresh tokens rotate on use.
No stored cloud keys
Our servers and deployments use short-lived AWS credentials rather than long-lived access keys.
Audit and oversight
Workspace audit log
Sign-ins, access changes, AI use, data changes and exports are logged with who, when and from where. Admins can view and export it, and it is kept for 12 months by default.
Project history
Every upload, AI run, decision, override and report transition on a project is recorded.
People approve AI output
AI proposes register entries, scope and draft text. A person accepts, edits or rejects each proposal.
AI providers
AI features use models from Amazon Bedrock and Microsoft Azure AI Foundry. Section 4 of our Privacy Policy explains how prompts and outputs are handled.
Privacy Policy, section 4
Operations
Backups
Production databases are backed up automatically and kept for 30 days, with a snapshot taken before every release.
Vulnerability scanning
Dependencies are scanned for known vulnerabilities every week, and a release cannot ship without a recent clean scan.
Reporting an issue
Report a suspected vulnerability to security@ecosphere-intelligence.com. We will acknowledge it and keep you informed.
Data protection
EcoSphere Intelligence Limited is registered in Ireland, and our lead supervisory authority is the Irish Data Protection Commission. Customer content is processed under a Data Processing Agreement.
Privacy Policy, section 12
Certifications and reviews
Ask us for the detail
We do not hold ISO 27001 or SOC 2 certification today. We are happy to complete your security questionnaire, share our architecture and sub-processor list under NDA, and walk your IT and information security teams through how the platform is built.
See it on one of your projects
Book a 45-minute walkthrough. Bring a live or recent assessment and we will show you how it would run in EcoSphere Intelligence.