Security at CarbonOS
This page summarizes how we protect tenant data. Detailed evidence packs, completed questionnaires, and architecture diagrams are provided under NDA for enterprise customers.
Security overview
CarbonOS is engineered for multi-tenant isolation first. Controls are designed to be explainable to enterprise security teams and mapped to common questionnaire frameworks.
Data protection
Encryption in transit (TLS 1.3), encryption at rest for stored objects, and strict separation between environments. Emissions are calculated deterministically from published conversion factors with a versioned, auditable engine—not by AI or machine learning.
Tenant isolation
Database row-level security (RLS) policies enforce organization boundaries. Application code paths require an explicit tenant context for data access.
Authentication
Session-based authentication with hardened cookie attributes. Sign-in is email and password only—managed through Supabase Auth with secure cookies.
Audit logs
Security-relevant events are recorded for accountability: authentication, administrative actions, exports, and configuration changes. Retention scales by plan.
Infrastructure
Hosted on ISO 27001 and SOC 2 Type II certified infrastructure within the EEA. Operational access is limited, logged, and reviewed.
Incident response
Defined severity levels, customer notification timelines aligned to GDPR Article 33 where applicable, and post-incident review with corrective actions.
Compliance commitment
We maintain documentation suitable for GDPR-aligned procurement: DPA, subprocessor disclosures, and architecture summaries under NDA.
Supabase & RLS
Authorization is enforced at the database layer using Postgres RLS tied to organization membership. Application services assume least privilege credentials and cannot bypass tenant boundaries without a documented break-glass procedure.
Operational integrity
Changes to authentication, billing, and exports follow release controls. We maintain separation between production and non-production data and test destructive operations against synthetic tenants only.