Tenant isolation
Every client is a separate tenant on a shared database, and isolation is enforced by the database itself, not only by application code.
- Row-level security, enabled and forced on every client-owned table. Each request sets the tenant context, and PostgreSQL refuses rows from any other tenant, even if application code has a bug.
- Tenant-scoped foreign keys. References between client tables include the tenant, so one tenant’s records cannot point at another’s.
- Automated leakage tests. A cross-tenant test suite enumerates every API route and table, and fails the build if a new one is added without an isolation test.
- Scoped access inside a tenant. Users can be limited to countries or assets, and the scope is applied in the database query.
- No default platform access to your data. Platform administrators cannot see client emissions data. Support access must be approved by the client, is time-limited and is audited.
Identity & access
- Sign-in with OpenID Connect and PKCE through Keycloak.
- Multi-factor authentication (an authenticator app, with recovery codes) is required for every password sign-in and set up at first sign-in. Users who sign in through their company’s identity provider use that provider’s MFA.
- Roles for client admin, methodology owner, data provider, reviewer, country manager, executive viewer and external verifier. External verifier and read-only viewer accounts are free on every plan.
- Single sign-on with your own identity provider (for example Entra ID or Okta) is on our roadmap for Professional and Enterprise.
Data integrity & audit
- Append-only audit log of changes.
- Reporting periods move from open to locked; changes to locked periods require a restatement.
- Calculated results retain their applicable inputs, gas analysis where used, factor, method version and library release.
- Original uploaded workbooks are kept as evidence.
Safe file handling
Spreadsheets are the main way data enters the platform, so uploads are handled defensively:
- Macros are never executed; macro-enabled content, ActiveX, embedded objects and external links are rejected.
- File size, row count and compression-ratio limits stop zip bombs; XML entity expansion is blocked.
- Parsing runs in a background worker, never in the web request.
Backups & recovery
Backup destination, retention, monitoring and restore procedures are deployment-specific and are set out in the applicable service terms. Before customer production data is onboarded, the selected environment must have its off-host backup configured and a restore test verified.
The Service Level Agreement sets out the contractual availability and recovery commitments for each hosting option.
Infrastructure
- Data in transit is encrypted with TLS.
- Hardened Linux hosts: firewall limited to web and SSH ports, SSH keys only, intrusion blocking and automatic security updates.
- Containers run as non-root, secrets are kept out of source control, and dependencies and images are scanned for known vulnerabilities.
- The application is developed against OWASP ASVS Level 2.
Hosting & data residency
- Shared cloud: the standard multi-tenant platform, included in every plan.
- Dedicated hosting: an isolated server and database managed by FEEC, with the hosting region agreed in your order form.
- Self-hosted: run the same software in your own infrastructure under an annual licence.
All tiers run the same software and database migrations, so security fixes reach every deployment.
Sub-processors
The current list of sub-processors, with their locations, is published on the sub-processors page. The Data Processing Agreement describes our technical and organisational measures.
Certification & testing
We do not hold ISO 27001 or SOC 2 certification today, and we will not claim otherwise. We run a lightweight information-security management system (policies, risk register, access reviews) from the start, and certification is on our roadmap. An independent external penetration test is scheduled before general availability and will be repeated yearly; a summary will be available under NDA.
We are happy to complete your security questionnaire. Ask us through the contact form or at sales [at] emitledger.com.
Reporting a vulnerability
Please report security issues to security [at] emitledger.com. Our security.txt has the details.