Security
Your emissions data and biodiversity records are commercially sensitive. Here is exactly how we protect them — no vague assurances.
Certifications & compliance
UK government-backed cybersecurity certification covering firewalls, access control, patch management, and malware protection.
Information Security Management System certification. Phase 1 controls implemented. Stage 1 audit targeted for Year 2.
Required for US enterprise customers. Audit period beginning Year 2. Controls audit-ready per the Trust Service Criteria for Security.
ICO registered. DPA available for all paid customers. Data subject rights implemented. Breach notification process documented.
Technical controls
Authentication
- JWT access tokens with 15-minute expiry
- 7-day HttpOnly refresh cookies — no client-side token storage
- Server-side token revocation via JTI UUID table — logout is immediate
- Argon2id password hashing (memory-hard, resistant to GPU cracking)
- TOTP multi-factor authentication for SuperAdmin accounts
- Rate-limited login endpoint — brute-force protection
Data isolation
- Single-database multi-tenancy with row-level entity scoping
- TenantQueryMiddleware injects EntityId filter on every authenticated queryset
- EntityId is always taken from the authenticated session — never from request body
- Cross-tenant data access is architecturally impossible, not just policy-blocked
- All API endpoints require explicit authentication — no anonymous data access
Encryption
- AES-256 encryption at rest for all database and file storage (AWS RDS + S3)
- TLS 1.3 in transit — TLS 1.2 as minimum fallback
- HTTPS enforced with HSTS (1-year, preload-eligible)
- Sensitive environment variables stored in AWS Secrets Manager — never in code or DB
- Database credentials rotated on a scheduled basis
Audit & monitoring
- Immutable audit log for every create, update, delete, state change, and login
- Audit entries include user identity, timestamp, entity context, and changed values
- Retention tiers: 30 days (Free), 1 year (Starter/Professional), 7 years (Enterprise)
- Application error monitoring via Sentry with PII scrubbing before upload
- Infrastructure monitoring via AWS CloudWatch and GuardDuty
- Verified GHG inventories are immutable — edits are rejected at the API level
Availability & recovery
- Multi-AZ PostgreSQL with automated daily backups (30-day retention)
- Point-in-time recovery available for the preceding 35 days
- Redis Cluster for session and task queue resilience
- S3 versioning enabled on file storage buckets
- Infrastructure as code — full environment reproducible from configuration
Incident response
- Security incidents are assessed within 4 hours of detection
- Personal data breaches reported to ICO within 72 hours as required by UK GDPR
- Affected customers notified within 24 hours of SusDevOS becoming aware
- Internal breach register maintained regardless of notification threshold
- Post-incident review and corrective action within 14 days
Responsible disclosure
If you discover a security vulnerability in SusDevOS, please report it to security@susdevos.com. We ask that you:
- Give us reasonable time to investigate and fix before public disclosure
- Avoid accessing, modifying or deleting data that is not yours
- Do not perform denial-of-service attacks or social engineering
- Provide enough detail for us to reproduce the issue
We aim to respond within 24 hours and resolve confirmed vulnerabilities within 30 days. We do not currently offer a bug bounty programme, but we will always acknowledge your contribution.
Penetration testing
SusDevOS undergoes annual penetration testing by an independent third-party security firm. The most recent test was conducted in Q1 2026. All critical and high-severity findings were remediated before going to production.
Enterprise customers can request a copy of the executive summary under NDA. Contact security@susdevos.com.
Security questionnaires
Completing procurement security questionnaires? Email us at security@susdevos.com and we'll respond within 3 business days.
Sub-processors
The following third parties process personal data on our behalf. External data providers (DEFRA, Climatiq, GBIF, ECB) receive only non-personal query data.
| Processor | Purpose | Data location |
|---|---|---|
| Amazon Web Services | Cloud infrastructure, database, file storage | UK/EU |
| Stripe | Payment processing and subscription billing | UK/EU |
| Sentry | Error monitoring (PII scrubbed before upload) | US (SCCs) |
Customers are notified 30 days before any new sub-processor is added. Full list available in the DPA.