Trust and security

What protects your data, what we do with it, and what is not finished yet. Written from how the platform works, not from a brochure.

Every organization is isolated

Your data sits in tables protected by row-level security that is forced for every tenant table. A request without an organization sees zero rows.
Your role is read from the database on every request, not from the sign-in token, so removing a member or changing a role takes effect at once.
The database roles of the API and the worker cannot bypass these rules and the audit log can only be added to.

Sign-in is OpenID Connect with multi-factor authentication at the identity provider. Machine access uses API keys that are stored only as a hash, shown once and revocable.
Access is by role, checked on the server. Invitations are one-time, expire in 7 days and are tied to a verified e-mail address.
The platform plans changes but never executes them in your cloud. A plan needs an approved recommendation and a second human approval; machine keys can never approve.

Access is read-only and made by you: a role or service account with billing and usage read permissions, protected against the confused-deputy problem by an identifier unique to each connection.
Where a secret has to be kept (for example a service principal secret), it is sealed with AES-256-GCM bound to your organization, can only be written, and never appears in a response, a log or an export.

We process billing and usage records and resource metadata. We do not read the content of your workloads or storage.
The owner can export all of the organization's data at any time, and can delete the organization: after a grace period (14 days by default) it is erased in one transaction together with its files, and only a record of counts remains.
Every change is written to an audit log in the same transaction as the change. Backups keep data until they age out.

Identity provider for sign-in (OpenID Connect).
Payment providers for plans: Stripe, Paddle, LiqPay, WayForPay or a payment link, depending on the deployment. They receive payment data; we do not store card numbers.
Public grid-intensity sources (for example ENTSO-E, Energy-Charts, UK Carbon Intensity, IESO, Hydro-Québec, ONS) and, with a key, Electricity Maps. They receive only a region or zone, never your data.
The final list for your deployment, with hosting, is part of the data processing agreement.

No independent penetration test and no SOC 2 or ISO 27001 certificate yet. The platform is in alpha.
Not yet in place: single sign-on through SAML (sign-in is OpenID Connect today; SCIM provisioning exists, see the security model), signed images with an SBOM, and a published backup retention period.
Emission figures use provisional coefficients and are not meant for a published statement yet; the Methodology page says which.