EcoCloud — Trust Center

All systems operational · live health endpoint

How your data is protected

01Workspace isolation

Every workspace is isolated at the database level with row-level security. One tenant can never read another's data — enforced in Postgres, not just the app.

02Tamper-evident audit

Agent actions are recorded in a SHA-256 hash-chained ledger with ES256-signed Merkle checkpoints. Any silent edit breaks the chain — provably. Compliance export on demand.

03Governed agents

Agents act through scoped, rate-limited, audited keys, checked against a per-workspace constitution + RBAC, with a one-switch kill-switch and human approval for risky actions.

04Encryption

All traffic is TLS in transit. Stored AI keys (BYOK) are AES-256-GCM encrypted at rest and never returned to the browser.

05Backend lockdown

Anonymous access to internal functions is revoked; the API is origin-locked to the official app and abuse-rate-limited. Function search paths are pinned.

06Your own keys & data

Bring your own AI model key so inference runs on your account. Export your data (CSV) or delete it anytime. We never sell data or use it for ads.

AI-specific handling — exactly what the model sees, what we store, and an honest OWASP LLM Top 10 mapping: /trust/ai/.

Key custody — honestly

The question a regulator will ask is "who holds your signing keys?" Here is the real answer:

• Today: EcoCloud's ES256 signing keys are platform secrets under single-operator custody. The public halves are at /.well-known/flowdesk-signing-key.json; keys are separated by role (receipts · envelopes · webhooks) and rotate by kid.
• What signatures DO protect against: tampering after the fact, third-party forgery, and silent history edits — the hash chain breaks provably. Anyone can verify offline, without trusting our database.
• What they DON'T: a malicious platform operator could sign false statements. That's true of every single-party SaaS — we're the ones saying it out loud.
• Threshold custody (k-of-n across independent parties) is a researched roadmap item. We publish the building block — Shamir secret sharing, live in your browser — but we will not market "no single party can sign" until independent parties actually hold shares. A committee whose shares all live in one operator's account would be theater.

Subprocessors

We share data only with vendors that help operate EcoCloud, under contract:

Provider	Purpose	Notes
Supabase	Database, authentication, storage	Postgres + RLS
Cloudflare	Hosting, CDN, edge functions, security	TLS, DDoS, WAF
Anthropic	AI processing of submitted text	Transient; BYOK optional
Stripe	Payment processing (if you subscribe)	We never see full card details

Compliance posture — honestly

We believe in saying what's true, not what sounds good:

• GDPR-aligned data handling: data minimisation, export, and deletion are built in.
• SOC 2 / ISO 27001: not yet certified — we're an early-stage product and won't claim badges we don't hold. The controls above (isolation, audit, encryption, least-privilege) are the foundation those audits assess. Enterprise evaluating us: we're happy to walk through the architecture and a security questionnaire directly.
• Data residency: primary region is single-region today; multi-region/residency is on the roadmap for enterprise.

Incident history

Security incidents affecting customer data, to date: none. We'll publish any incident here, including the ones where the answer is "none."

Reach us

Security questions, disclosures, or an enterprise review: [email protected]. Responsible disclosure welcome — see /.well-known/security.txt.

// the governed loopsimulate→constitution→execute→signed→verifyES256 · audit-chained

Trust,rendered as receipts.