Hosting and security
The platform stores client project documents and assessment records, including site data. Each client’s data is kept separate, encrypted at rest and in transit, and every action is recorded in an audit log.
Data hosting
Hosting
Your data is held with our cloud hosting providers, listed with where data is stored in the sub-processor register.
Read the sub-processor registerSub-processors
The public register names every provider that processes personal data for us, including the model providers, what each processes and in which countries, with a dated change history.
Workspace separation
Separate workspaces
Each client’s data is kept separate from every other client’s, and access is limited to the members of the workspace.
Role-based access
Owner, admin, member, viewer and guest roles control what each person can see and change.
Encryption
At rest and in transit
Data is encrypted at rest and in transit, and file storage refuses unencrypted connections and blocks public access.
Credentials
Integration credentials and application secrets are stored encrypted, and our servers and deployments use short-lived credentials rather than long-lived keys.
Sign-in and access
Single sign-on
Workspaces support single sign-on through Microsoft Entra ID, Okta or Google, so your multi-factor authentication and joiner-leaver policies apply.
Sessions
Sign-in sessions expire and must be renewed, and a revoked session cannot be reused.
Audit and oversight
Workspace audit log
Every sign-in, access change, artificial intelligence run, data change and export is recorded with who did it, when and from where. Admins can view and export the log, which is kept for 12 months by default.
Project history
Each upload, artificial intelligence run, decision, override and report status change on a project is recorded.
Review of artificial intelligence output
Artificial intelligence proposes register entries, a scope and drafts. A person accepts, edits or rejects the output.
No training on customer data
We instruct our model providers, by contract, not to use your prompts, inputs or outputs to train their models. The model providers we use are listed in the sub-processor register.
Privacy Policy, section 4
Operations
Backups
Data is backed up automatically and kept for 30 days, with a snapshot taken before every release.
Vulnerability scanning
Dependencies are scanned regularly for known vulnerabilities, and a release cannot ship without a clean scan.
Reporting a vulnerability
Report a suspected vulnerability to security@ecosphere-intelligence.com. We will acknowledge it and keep you updated while we work on it.
Data protection
EcoSphere Intelligence Limited is registered in Ireland, and our lead supervisory authority is the Irish Data Protection Commission. Customer content is processed under a Data Processing Agreement.
Privacy Policy, section 12
Certifications and security reviews
We do not hold ISO 27001 or SOC 2 certification. We complete security questionnaires and share architecture details and the sub-processor list under a non-disclosure agreement, and we can take your technology and information security teams through how the platform is built.