Security built for data your supplier would rather not share by email.
Fuel bills, production records, monitoring plans. Sensitive to the operator; essential to the declaration. Our job is to make the exchange safe for both sides — and to make a verifier's job painless.
What's in place today.
High-level controls across access, encryption, isolation and operations. Every item below is live, not aspirational.
-
GDPR
DPA on request
-
EU hosting
AWS eu-central-1
-
TLS 1.3
in transit
-
AES-256
at rest
-
RBAC
per tenant
-
Audit log
append-only
Controls
Six layers that handle supplier data.
Access
Role-based access per tenant
Importer, supplier and verifier each sit in their own tenant with permissions scoped to the roles that make sense for their work. No cross-tenant data unless explicitly shared.
Audit
Append-only audit log
Every state change is logged with who, when and what. Deletes are soft; the audit record stays. A verifier can walk the full history for any value.
Encryption
TLS in transit, AES at rest
TLS 1.3 between browser and API. Postgres encrypted at rest. Object storage encrypted at rest. Secrets rotated per environment and never logged.
Isolation
Row-level tenancy on every query
Repositories take a tenant context and filter by organisation on every read and write. We ship cross-tenant tests to prevent regressions.
Supply chain
Dependencies tracked and pinned
Lockfiles committed. Automated vulnerability alerts via npm audit and dependabot. Patch cadence documented.
Operational
Backups and recovery
Nightly Postgres snapshots retained for 14 days by default, with off-site sync. Restore drills run on a schedule.
Data flow
Who sees what, in one picture.
What suppliers send
Fuel bills, electricity bills, production records, monitoring plan version, precursor origin. Photos of paper documents are OK — we read, they confirm.
What importers see
The confirmed values, linked to the uploaded documents. The actual-vs-default comparison, labelled estimate until verified.
What verifiers see
Read-only workspace for the installation they are reviewing. Full audit trail. Evidence attached to every value.
Suppliers choose which EU buyers see their data. Sharing is explicit; revocation is one click.
Sub-processors
Who else processes CBAMWorks data.
A current snapshot. The canonical list lives on the sub-processors page with transfer-mechanism details.
| Processor | Purpose | Location | Transfer |
|---|---|---|---|
| Amazon Web Services (AWS) | Application hosting + database | EU (eu-central-1) | DPA + SCCs |
| Cloudflare | CDN, DNS, Workers (marketing site) | Global edge | DPA + SCCs |
| Stripe | Payments and billing | EU / US | DPA + SCCs |
| Zoho Books | Invoicing and accounting | EU / India | DPA + SCCs |
| Resend | Transactional email | EU | DPA |
| OpenAI | Bill-number extraction (opt-in) | EU / US | DPA + SCCs; no training on your data |
| Meta (WhatsApp Cloud API) | Supplier messaging | EU / US | DPA + SCCs |
| Plausible | Cookieless website analytics | EU | DPA |
Facts checked on 2026-10-18.
Not yet in place
Things we don't claim and would rather be upfront about.
- • SOC 2 Type I/II. Not yet in place; we don't claim it. A formal audit is on the roadmap for 2027.
- • ISO 27001. Same as above — on the roadmap, not yet claimed.
- • Named customer references. Pilot cohort is being onboarded now; we publish testimonials only after written consent.
Need a DPA or security questionnaire?
Email hello@cbamworks.com and we'll return it within one working day.