Tenant isolation
Every client is a separate tenant on a shared database, and isolation is enforced by the database itself, not only by application code.
- Row-level security, enabled and forced on every client-owned table. Each request sets the tenant context, and PostgreSQL refuses rows from any other tenant, even if application code has a bug.
- Tenant-scoped foreign keys. References between client tables include the tenant, so one tenant’s records cannot point at another’s.
- Automated leakage tests. A cross-tenant test suite enumerates every API route and table, and fails the build if a new one is added without an isolation test.
- Scoped access inside a tenant. Users can be limited to countries or assets, and the scope is applied in the database query.
- No default platform access to your data. Platform administrators cannot see client emissions data. Support access must be approved by the client, is time-limited and is audited.
Identity & access
- Single sign-on with OpenID Connect and PKCE through Keycloak, with multi-factor authentication.
- Roles for client admin, methodology owner, data provider, reviewer, country manager, executive viewer and external verifier.
- Bring your own identity provider (for example Entra ID or Okta) on Professional and Enterprise. Rolling out.
Data integrity & audit
- Append-only audit log of changes.
- Reporting periods move from open to locked; changes to locked periods require a restatement.
- Provenance on every calculated result: inputs, gas analysis, factor, method version and library release.
- Original uploaded workbooks are kept as evidence.
Safe file handling
Spreadsheets are the main way data enters the platform, so uploads are handled defensively:
- Macros are never executed; macro-enabled content, ActiveX, embedded objects and external links are rejected.
- File size, row count and compression-ratio limits stop zip bombs; XML entity expansion is blocked.
- Parsing runs in a background worker, never in the web request.
Backups & recovery
- Nightly encrypted, off-site backups of the database and stored files.
- A documented full-restore procedure with a target recovery time of 4 hours and a target recovery point of 24 hours.
- Restore tests are part of the operating routine, planned quarterly.
Infrastructure
- Traffic is encrypted in transit with TLS.
- Hardened Linux hosts: firewall limited to web and SSH ports, SSH keys only, intrusion blocking and automatic security updates.
- Containers run as non-root, secrets are kept out of source control, and dependencies and images are scanned for known vulnerabilities.
- The application is developed against OWASP ASVS Level 2.
Hosting & data residency
- Shared cloud: the standard multi-tenant platform, included in every plan.
- Dedicated hosting: an isolated server and database managed by FEEC, in the EU, the Middle East or Singapore.
- Self-hosted: run the same software in your own infrastructure under an annual licence.
All tiers run the same software and database migrations, so security fixes reach every deployment.
Subprocessors
The current list of subprocessors is published on the subprocessors page.
Certification & testing
We do not hold ISO 27001 or SOC 2 certification today, and we will not claim otherwise. We run a lightweight information-security management system (policies, risk register, access reviews) from the start, and certification is on our roadmap. An external penetration test is planned before the first paying client, then yearly.
We are happy to complete your security questionnaire. Ask us through the contact form.
Reporting a vulnerability
Please report security issues to security@emitledger.com. Our security.txt has the details.