Security
Built to be audited, including by your IT team.
Carbon figures end up in annual reports and tenders, so the controls around them need to be as checkable as the numbers.
Controls
What protects your data.
Organisation isolation
Every record belongs to one organisation, and every query is scoped to it after the user's membership is checked on the server. Automated tests try to read and write across organisations on each change.
Six roles
Admin, editor, reviewer, viewer, auditor and field worker. Roles are read from the membership record, never from anything the browser or phone sends.
Files and downloads
Evidence, imports and reports sit in private storage. Download links are created on the server after the access check and expire after an hour.
Append-only audit trail
Sign-ins, role changes, imports, record edits, calculation runs, publications, report downloads and reviews are recorded. Each entry includes a hash of the one before it, so a gap or edit shows.
Immutable snapshots
Publishing freezes a calculation run. Reports from that snapshot always reproduce the same figures, and recalculating creates a new version.
Database access
The application connects to PostgreSQL through its own server code only. Row-level security denies the database's public API roles on every table.
Rate limits and headers
Sign-in, upload and write endpoints are rate-limited. Responses carry frame protection, a strict referrer policy, a permissions policy and strict transport security.
Backups
The database is dumped nightly, encrypted with AES-256 and stored privately, with daily copies kept 35 days and monthly copies kept longer. A restore is rehearsed every week.
Where it runs
Infrastructure and people.
MetricOra is a hosted service. The web app runs on Vercel and data is held in a managed PostgreSQL database and private object storage.
- Sign-in sessions are stored in our own database, not a separate identity provider
- Enterprise plans can sign in with SAML or OpenID Connect
- Error monitoring uses Sentry's EU region
- You choose how long evidence files are kept under Settings, then Data retention
- Subject access exports and erasure requests are handled in the product
Ask us for our data processing agreement, sub-processor list and hosting regions.
*Demo data
Walk through the controls with us.
We can take your IT or procurement team through access, retention and hosting on a call.