Built for enterprise scrutiny.
What a security, privacy or procurement reviewer can rely on — control by control, with an honest status for each.
Every line carries one of three states. Available today means the control is in place in the production platform. Planned means it is on the engineering roadmap and not yet live. Not publicly disclosed means it exists or is in progress, and detail is shared under agreement rather than on this page. EcoVeraZ holds no certifications today and does not claim any.
Control by control.
| Area | Control | Status | What it means for you |
|---|---|---|---|
| Identity & access | Role-based access with separate preparer, checker and issuer roles | Available today | No report or certificate is issued by the person who prepared it. Access is deny-by-default and granted per capability. |
| Identity & access | Tenant isolation | Available today | Each customer's data is separated by organisation; isolation is covered by the platform's tests. |
| Identity & access | Hashed credentials, expiring token-based sessions, rate limiting | Available today | Passwords are never stored in clear; sessions expire; repeated attempts are throttled. |
| Identity & access | Single sign-on (SAML / OIDC) | Planned | Enterprise identity providers will be supported; timing is shared under agreement. |
| Identity & access | Multi-factor authentication | Planned | Second-factor sign-in is on the roadmap. |
| Data protection | Encryption in transit | Available today | All traffic to the website and the platform is HTTPS; the website enforces HSTS. |
| Data protection | Encryption at rest | Available today | Stored customer data and evidence files are encrypted at rest; key handling is described under agreement. |
| Data protection | Malware scanning of uploads | Available today | Every document uploaded as evidence is scanned before it is stored. |
| Data protection | Backups and recovery objectives | Not publicly disclosed | Backup cadence, retention and recovery targets are shared with customers under agreement. |
| Evidence integrity | Reviewed-evidence gate | Available today | Only evidence that has been reviewed by a person feeds a published figure. |
| Evidence integrity | Trusted timestamps on issued reports | Available today | Issued reports are timestamped by an RFC 3161 time-stamping authority and the timestamp is stored with the report, so the time of issue can be verified independently. |
| Evidence integrity | Cryptographic integrity references | Available today | Evidence records and issued artefacts carry a SHA-256 integrity reference, so any later change is detectable. |
| Evidence integrity | Merkle batch anchoring of issued artefacts | Planned | Batch anchoring is built and tenant-scoped; it is not yet claimed as running in production. |
| Evidence integrity | Public figure verification | Available today | A figure on an issued report can be checked at a public verification address without an account. |
| Evidence integrity | Versioning and revocation without deletion | Available today | A superseded or revoked artefact keeps its history; nothing is silently overwritten. |
| AI (Copilot) | Answers grounded in the customer's own evidence, with the figures and sources cited | Available today | Copilot retrieves from your evidence base and lists what it used; it does not answer from the open web. |
| AI (Copilot) | Customer data is not used to train models | Policy | A standing commitment, restated in the DPA. |
| AI (Copilot) | Model provider, version and prompt-injection controls | Not publicly disclosed | Described in the AI governance note available under agreement. |
| Hosting | Web and application hosting on Vercel; backend services and databases on Microsoft Azure | Available today | See the subprocessor list below. |
| Hosting | Data residency options | Not publicly disclosed | The hosting region is stated in the DPA; additional regions are discussed per contract. |
| Monitoring | Audit logging of security-relevant actions | Available today | Sign-ins, evidence changes, approvals and issuances are logged. |
| Monitoring | Dependency monitoring and patching | Available today | Third-party components are monitored for published vulnerabilities and patched on a schedule. |
| Monitoring | Independent penetration testing | Planned | Results will be shared with customers under agreement once complete. |
| Assurance | SOC 2 / ISO 27001 | Planned | Evidence collection is in progress. No certification is held or claimed today. |
| Privacy | Data Processing Addendum, retention and deletion terms | Available today | Published on this site; return and deletion at end of contract are set out in the DPA. |
| Privacy | Responsible disclosure | Available today | Security contact published in /.well-known/security.txt; reports are acknowledged promptly. |
| Procurement | Security questionnaire support and documentation under NDA | Available today | Architecture overview, isolation approach, access model, backup approach and retention summary. |
Statuses describe the production platform at the review date above. Website demonstrations use synthetic data only and never touch customer evidence.
Who processes customer data.
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting and content delivery for the website and the customer application | United States; global edge network |
| Microsoft Azure | Backend services, evidence store and databases | Region stated in the DPA |
| Formspree | Delivery of website enquiry and demo-request forms | United States |
Customers are notified of additions to this list under the DPA. Providers used only for the public website do not process customer evidence.
Website security
This site runs with a strict content-security policy, no third-party scripts, no cookies and no analytics. Every page and asset is served over HTTPS with security headers set at the edge.
Report a vulnerability
If you believe you have found a security issue, write to info@ecoveraz.com. We acknowledge reports promptly and do not pursue good-faith researchers.
Legal documents
Privacy policy · Terms of use · Data Processing Addendum. The current versions are marked preliminary pending counsel review before production use.
See the evidence behind your numbers.
A 30-minute walkthrough on your own data, with your own questions.