Security

1. Overview

SOSCO is a sustainability compliance platform used by companies to manage regulatory obligations, evidence, and reporting. Our customers trust us with commercially sensitive and, in some cases, personal data, so we treat security as a product requirement rather than an afterthought.

This page describes the controls that are in place today. Where a control is still being built out, we say so explicitly rather than implying coverage we do not yet have.

2. Infrastructure and Data Residency

All customer data is stored and processed in the European Union.

• Application hosting: Vercel, served from the EU (Frankfurt) region.
• Primary database and file storage: Supabase (PostgreSQL), hosted in the EU West region.
• No customer data is stored outside the EU by the application itself. Where a subprocessor may process data outside the EU, that is disclosed on our subprocessors page.

3. Encryption

• In transit: all traffic is served over HTTPS (TLS). Plain HTTP requests are permanently redirected to HTTPS before reaching the application.
• HSTS: we send Strict-Transport-Security with a one-year max-age, includeSubDomains, and preload, so conforming browsers refuse to connect over plain HTTP.
• At rest: database and file storage are encrypted at rest by our infrastructure providers.

4. Tenant Isolation

SOSCO is multi-tenant. Separation between customers is enforced at the database layer, not only in application code.

• PostgreSQL Row Level Security is enabled and forced on tenant-scoped and user-scoped tables.
• Application requests run under a dedicated PostgreSQL role that cannot bypass those policies. The tenant and user identity are set inside the same transaction as the query, so context cannot leak between pooled connections.
• Shared reference data with no tenant dimension (for example public regulatory texts) is deliberately readable across tenants; it contains no customer information.
• Administrative operations that legitimately need cross-tenant reach are restricted by role and require multi-factor authentication.

5. Authentication and Access Control

• Authentication is handled by Better Auth, with password and email-verification flows.
• Time-based one-time password (TOTP) multi-factor authentication is supported for user accounts and is mandatory for privileged administrative access.
• Access to production systems is limited to the engineering team on a least-privilege basis and reviewed periodically as part of our joiner-mover-leaver process.

6. Application Security

• Content Security Policy: an enforcing CSP restricts scripts, styles, images, and network connections to an explicit allowlist of origins. Violations are reported back to us.
• Security headers: X-Frame-Options: DENY (clickjacking), X-Content-Type-Options: nosniff (MIME sniffing), Referrer-Policy, and a Permissions-Policy disabling camera, microphone, geolocation, and payment APIs.
• Input validation: every API input is validated against a strict schema that rejects unexpected fields and bounds every string and array, guarding against mass-assignment and resource-exhaustion attacks. This is enforced automatically in CI.
• Output escaping: user-supplied content is escaped on render, and rich-text content is sanitised before it is stored.
• Automated checks on every change: dependency vulnerability auditing, dependency review, and secret scanning run in continuous integration. A scheduled OWASP ZAP baseline scan runs against our staging environment.

7. Subprocessors

We publish a complete, current list of the third-party services that process customer data on our behalf, including what each one is used for.

View our subprocessors

8. Compliance Posture

• GDPR: SOSCO is operated from Portugal and processes personal data in accordance with the GDPR. Our Data Processing Agreement is available to all customers, and our Privacy Policy describes data subject rights and how to exercise them.
• ISO/IEC 27001: we operate an information security management system aligned to ISO/IEC 27001, including a risk register, a Statement of Applicability, and documented policies. SOSCO is not currently ISO/IEC 27001 certified; this is a readiness programme, not a certification claim.
• SOC 2: SOSCO does not currently hold a SOC 2 report.

9. Incident Response

We maintain a documented incident response plan covering detection, triage, containment, customer notification, and post-incident review. Application errors and anomalies are monitored continuously.

Where an incident involves personal data, we will notify affected customers without undue delay and support them in meeting their own notification obligations under Article 33 of the GDPR.

10. Reporting a Vulnerability

We welcome reports from security researchers and will not pursue legal action against researchers who act in good faith, avoid privacy violations and service degradation, and give us reasonable time to remediate before public disclosure.

Report suspected vulnerabilities to legal@sosco.io with the subject prefix Security vulnerability. Machine-readable contact details are published at /.well-known/security.txt.

Please include:

• The affected URL, API route, or feature.
• Steps to reproduce.
• Impact and affected data, if known.
• Screenshots or logs, with secrets removed.

Please do not include passwords, API keys, database connection strings, service keys, or customer personal data in your report.

Our response targets

• Confirmed or suspected customer-data exposure, or unauthorised privileged access: first response within 24 hours, daily updates until contained.
• Serious vulnerability without known exploitation: first response within 2 business days, weekly updates until fixed.
• Lower-risk issues and hardening requests: first response within 5 business days.

Questions about security for a procurement or vendor review? Contact us at legal@sosco.io or via our contact page.