Trust and security

Controls

• Governance

  Security is run as a management system aligned to ISO 27001:2022 and owned by our Chief Information Security Officer. It has a statement of applicability, a risk register, an internal audit programme and a management review, and corrective actions are tracked.

• Access control and single sign-on

  Access to a workspace is limited to its members, and owner, admin, member, viewer and guest roles control what each person can see and change. Workspaces support single sign-on through your own identity provider, so your multi-factor authentication and joiner and leaver rules apply. Sessions expire and must be renewed, and a revoked session cannot be reused.

• Data classification and handling

  Each client’s data is kept separate from every other client’s. Information is classified and handled according to its sensitivity under our data management and classification policy.

• Cloud and infrastructure security

  Data is encrypted at rest and in transit, and file storage refuses unencrypted connections and blocks public access. Integration credentials and application secrets are stored encrypted, and our servers and deployments use short-lived credentials. Where data is held is listed in the sub-processor register.

  Read the sub-processor register →

• Endpoint security

  The devices our people use for work are covered by our endpoint security policy.

• People

  People are screened before they start. Access is granted on joining and removed on leaving, and everyone acknowledges the information security policy.

• Supplier and third-party security

  Suppliers are assessed and managed under our supplier and third party security policy. Those that process personal data for us are listed in the public sub-processor register, with what each processes and in which countries, and a dated change history.

• Vulnerability and patch management

  Dependencies are scanned regularly for known vulnerabilities, and a release cannot ship without a clean scan. Patching follows our vulnerability and patch management policy.

• Logging and monitoring

  Every sign-in, access change, artificial intelligence run, data change and export in a workspace is recorded with who did it, when and from where. Admins can view and export the log, which is kept for 12 months by default, and each project keeps its own history of uploads, runs, decisions, overrides and report status changes.

• Privacy and data protection

  EcoSphere Intelligence Limited is registered in Ireland, and our lead supervisory authority is the Irish Data Protection Commission. Customer content is processed under a Data Processing Agreement, and the Privacy Policy sets out what personal data we collect and why.

  Privacy Policy, section 12 →

• Artificial intelligence governance

  Artificial intelligence proposes register entries, a scope and drafts, and a person accepts, edits or rejects the output. We instruct our model providers, by contract, not to use your prompts, inputs or outputs to train their models. Each export carries an artificial intelligence use statement, and an impact assessment procedure covers our own use of artificial intelligence.

  Privacy Policy, section 4 →

• Operations

  Data is backed up automatically and kept for 30 days, with a snapshot taken before every release.