Security & Compliance
Last updated: March 2026 — CLIMATRIX is built with enterprise-grade security at every layer.
Our Commitment
CLIMATRIX handles sensitive environmental and operational data for organizations worldwide. We treat data security and privacy as foundational — not optional. Our platform is designed with defense-in-depth principles, multi-tenant isolation, and compliance with international standards including GDPR, GHG Protocol, ISO 14064, CSRD, and CBAM.
Platform Security
Encryption at Rest & in Transit
All data is encrypted using AES-256 at rest and TLS 1.2+ (HTTPS) in transit. Database connections, API calls, and file transfers are fully encrypted end-to-end.
Authentication & Access Control
Secure JWT-based authentication with bcrypt password hashing (work factor 12). Support for Google OAuth 2.0 SSO. Role-based access control (RBAC) with organization-level tenant isolation.
Rate Limiting & Abuse Prevention
API rate limiting on all sensitive endpoints — login (10/min), registration (5/min), password reset (5/min), and data imports (20/min). Protects against brute-force and credential-stuffing attacks.
Infrastructure Security
Hosted on Railway (backend) and Vercel (frontend) — both SOC 2 Type II certified providers. Automatic SSL certificate management, DDoS protection, and network-level firewalling included by default.
Multi-Tenant Data Isolation
Strict organization-level data isolation. Every database query is scoped to the authenticated user's organization. No cross-tenant data access is possible at the application layer.
Audit Logging
Comprehensive audit trail for all data modifications, user actions, and administrative operations. Logs include timestamps, user identifiers, and action details for full traceability.
Backup & Disaster Recovery
Automated daily database backups with point-in-time recovery. Infrastructure runs in highly available configurations with automatic failover and health monitoring.
Vulnerability Management
Continuous dependency scanning, automated CI/CD security checks, and regular code reviews. Input validation and parameterized queries protect against injection attacks (SQLi, XSS, CSRF).
Standards & Frameworks
CLIMATRIX is built on and aligned with the following international environmental and reporting standards.
GHG Protocol
Corporate Accounting & Reporting Standard for Scope 1, 2, and 3 emissions. The global benchmark for measuring and managing greenhouse gas emissions.
ISO 14064
International standard for quantification, monitoring, and reporting of GHG emissions and removals at the organizational and project level.
CSRD / ESRS
EU Corporate Sustainability Reporting Directive and European Sustainability Reporting Standards for mandatory ESG disclosures.
EU CBAM
Carbon Border Adjustment Mechanism — quarterly reporting of embedded emissions for goods imported into the EU, with certificate management.
TCFD
Task Force on Climate-related Financial Disclosures framework for climate risk reporting aligned with financial disclosures.
SBTi
Science Based Targets initiative — target setting and tracking aligned with Paris Agreement goals for net-zero pathways.
PCAF
Partnership for Carbon Accounting Financials — data quality scoring methodology for financial institutions' financed emissions.
DEFRA
UK Department for Environment, Food & Rural Affairs emission factors database used for accurate GHG conversion calculations.
Compliance & Privacy
We maintain compliance with applicable data protection regulations and industry best practices.
GDPR Compliance
Full compliance with the EU General Data Protection Regulation. Data minimization, right to erasure, data portability, and explicit consent management.
SOC 2 Ready
Platform architecture designed to meet SOC 2 Type II requirements across security, availability, processing integrity, confidentiality, and privacy.
Data Residency
Infrastructure deployed in regions that comply with local data residency requirements. Data processing and storage locations are transparent and documented.
Data Processing Agreement
Standard DPA available for all enterprise customers, covering data processing terms, sub-processors, and contractual obligations under applicable privacy laws.
Technical Security Details
| Category | Implementation |
|---|---|
| Password Hashing | bcrypt with work factor 12 |
| Session Tokens | JWT (JSON Web Tokens) with configurable expiration |
| Transport Security | TLS 1.2+ enforced on all endpoints (HTTPS only) |
| Data Encryption | AES-256 at rest (provider-managed keys) |
| API Rate Limiting | Per-endpoint limits with Redis-backed distributed counters |
| File Upload Limits | 50 MB maximum per upload with server-side validation |
| SSO | Google OAuth 2.0 (additional providers on request) |
| Database | PostgreSQL with parameterized queries (SQLAlchemy ORM) |
| CI/CD | GitHub Actions with automated linting, testing, and build verification |
| Error Monitoring | Sentry integration for real-time error tracking and alerting |
Security Inquiries
If you have security questions, need a detailed security questionnaire response, or want to report a vulnerability, please contact our security team.