Trust & Security
How we protect
your emissions data.
Your GHG inventory is compliance-critical data. This page documents how Sustaineve's infrastructure, access controls, and data policies protect it.
Infrastructure
The layers that protect the platform before a request reaches application code.
| Layer | Implementation |
|---|---|
| Hosting | Vercel — global edge network, auto-scaled, no origin server exposed to public internet |
| DNS + WAF | Cloudflare — DDoS protection, WAF rules, rate limiting applied before traffic reaches Vercel |
| SSL/TLS | Auto-managed SSL certificates, TLS 1.2+ enforced, HSTS preloaded across all Sustaineve domains |
| CDN | Cloudflare global CDN — content served from edge nodes, not origin infrastructure |
| Subdomain isolation | sustaineve.com and app.sustaineve.com on separate isolated Vercel projects — no shared infrastructure, no shared cookies |
| Security headers | CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy — all configured via astro-security-headers |
Your Data
What we collect, what we do not, and where it lives.
What we collect
- Company name and contact email
- Facility operational data (fuel consumption, electricity units)
- Emission data entered to calculate your GHG inventory
What we do not collect
- Payment or billing information
- Sensitive personal data beyond contact details
- Data from your ERP or accounting systems without explicit consent
Where data lives
-
Form submissions
HubSpot CRM — EU data processing agreement in place
-
Emission data
app.sustaineve.com — separate infrastructure from marketing website
-
Analytics
Google Analytics 4 (anonymised, no PII) + PostHog (session data, anonymised)
Data retention & deletion
Lead data
Retained until you request deletion
Emission data
Retained for duration of your account
Deletion requests
Honoured within 30 days — email [email protected]
Access Controls
Team access
No team member has access to customer emission data without explicit authorisation tied to a specific account.
Secrets management
All API keys and tokens are stored in Vercel encrypted environment variables — never in code, never in the repository.
Repository security
GitHub repository is private. Branch protection on main. Pull request review required for all changes to production.
Dependency scanning
GitHub Dependabot monitors all packages for CVE alerts automatically. Critical vulnerabilities trigger immediate response.
Third-party scope
All third-party integrations use minimum-scope API keys. HubSpot has forms-scope only. Cloudinary is upload-scope only.
Subdomain isolation
sustaineve.com (marketing) and app.sustaineve.com (product) run on entirely separate infrastructure with explicit SameSite cookie configuration.
Audit Trail
Every emission calculation in Sustaineve maintains a complete audit trail: data source, emission factor applied (IPCC version referenced), calculation methodology, timestamp, and user attribution.
This is not a feature — it is a compliance requirement. When your auditor asks how you arrived at 2,840 tCO₂e, you export the full methodology in one click.
Audit entry example
Responsible Disclosure
If you discover a security vulnerability in Sustaineve's website or platform, please report it to [email protected]. We will acknowledge receipt within 48 hours and provide a resolution timeline.
We do not pursue legal action against good-faith security researchers. Coordinated disclosure is appreciated — we ask for reasonable time to remediate before public disclosure.
Compliance Posture
HTTP security headers
CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy — all configured and verified.
GDPR
No personal data processed without consent. Data deletion on request. No PII in analytics. No advertising cookies.
DPDP Act (India)
Aligned with India's Digital Personal Data Protection Act requirements as they take effect.
Cookie policy
Minimal first-party cookies only. No third-party advertising cookies. Analytics data is anonymised.
Questions about our security posture? [email protected]