Trust Centre
This page states ēkotrace's security, privacy and compliance posture as it actually is — what platform controls are described, which frameworks are references, and what is on the roadmap. No third-party certification, accredited material certificate, laboratory report, penetration-test report or independent assurance opinion is represented on this page.
Owner: innovation@ekot.nz · No independent external review represented
Verify it yourself
ēkotrace's record-linkage check is publicly reproducible. The verifier recomputes the SHA-256 chain for recorded events:
Open the public record verifier → No login required. A successful check shows that the recorded hash links are consistent. It does not establish that the underlying entries are true, that a weight or material is accurate, or that a load reached a stated destination.
Our public AI Use Statement documents exactly where AI is and is not used in the platform.
Security controls
| Control | Detail | Status |
|---|---|---|
| Hash-linked event records | Recorded gate events are SHA-256 hash-chained, and the public verifier at /verify can recompute the chain. This checks whether recorded entries link consistently; it does not independently prove their accuracy, physical custody, material composition or safety, destination, or carbon benefit. | Implemented control · not independently audited |
| Encryption in transit | The application is configured to serve browser traffic over TLS and use encrypted connections to listed services. This configuration has not been independently tested or certified. | Implemented control · not independently audited |
| Encryption at rest | The database provider reports provider-managed encryption at rest. This does not represent an independent review of provider controls or ēkotrace certification. | Implemented control · not independently audited |
| Database API access controls | Application database access policies are configured in the platform. Their effectiveness and completeness have not been independently audited. | Implemented control · not independently audited |
| Authentication on internal routes | The application uses middleware to restrict non-public routes; no independent access-control assessment or penetration test is represented. | Implemented control · not independently audited |
| Human review of OCR | Document OCR is presented for human review before an extraction is accepted. This describes the configured workflow, not an external assurance of data accuracy. | Implemented control · not independently audited |
| Factor-based carbon scenarios | Some calculations cite Ministry for the Environment factors. Outputs depend on example inputs and assumptions; they are not independently verified emissions reductions, credits or assured GHG statements. | Implemented control · not independently audited |
| Per-user accounts, RBAC & MFA | Role-based access (Operator / Reviewer / Verifier / Admin) with MFA for privileged roles. | Roadmap |
| Multi-tenant isolation | Contractual gate before mixed-client production data shares a deployment. | Roadmap |
| External penetration testing | First external pen-test planned alongside ISO 27001 preparation. | Roadmap |
Today's access-control posture is appropriate for pilot, demo and single-tenant trial use. Multi-tenant production with mixed-client data is contractually gated on the roadmap items above.
Data residency & sub-processors
| Sub-processor | Purpose | Region |
|---|---|---|
| Replit, Inc. | Application hosting (autoscale runtime, TLS edge) | United States (GCP infrastructure) |
| Supabase | Primary PostgreSQL database | Singapore (AWS ap-southeast-1) |
| OpenAI | Document OCR only, via managed integration — no training on API inputs per provider terms | United States |
| Resend | Transactional email (team notifications only) | United States |
Residency roadmap: the current pilot deployment stores operational data in Singapore (database) with US-hosted application runtime. NZ/AU data residency is the contractual baseline we will stand up before onboarding Crown, Council or residency-sensitive enterprise clients — regional deployments are additive; client data is never consolidated into a single global database.
ēkotrace holds minimal personal information by design: no payment data, no marketing analytics, no location tracking, no customer-of-customer PII. Donor records are pseudonymous with masked contact hints only.
Standards & certification roadmap
No certification or external assurance is represented here. Standards and frameworks below are references or future objectives only; their listing is not a claim of compliance, conformity or alignment. ēkotrace has no accredited CRM material certificate or batch-linked independent laboratory report represented on this page.
| Standard | Position | Status |
|---|---|---|
| NZ Privacy Act 2020 | Legal framework reference only. No independent legal review or compliance assessment is represented. | Reference only · no conformity assessed |
| ISO/IEC 27001 (Information security) | A possible future management-system reference; no certification or external conformity assessment is represented. | Roadmap |
| SOC 2 Type 2 | No SOC 2 report or independent attestation is represented; any future work would require a separate assessment. | Roadmap |
| ISO/IEC 42001 (AI management) | Reference for AI governance only; no independent gap assessment, conformity assessment or certification has been completed. | Reference only · no conformity assessed |
| ISO 14064-1 / GHG Protocol | Methodology references only. Factor-based scenario calculations are not an independently verified GHG inventory or assured emissions-reduction claim. | Reference only · no conformity assessed |
| ISO 59014 / 59020 (Circular economy) | Standards references only; no independent material-flow mapping or conformity assessment has been completed. | Reference only · no conformity assessed |
| Algorithm Charter for Aotearoa NZ · NZ AI Forum principles | Policy and principles references only; no alignment assessment or public-sector endorsement is represented. | Reference only · no conformity assessed |
Documents available to reviewers
The following reviewer-facing documents are available on request to procurement, IT-security and privacy teams under NDA where required:
- Data Sovereignty Review (v1.0) — data inventory, cross-border flows, retention & deletion, breach notification, audit rights
- Disaster Recovery Runbook — backup cadence, restore procedure, RPO/RTO posture
- AI Use Statement (v1.0) — public at /ai-use
- Emission-factor citation register (MfE 2025 sources per figure)
Request access: email innovation@ekot.nz with the subject line "Trust Centre document request". We respond in writing within 5 business days.
Responsible disclosure
If you believe you have found a security vulnerability in the ēkotrace platform, please email innovation@ekot.nz with the subject line "Security disclosure". We commit to acknowledging reports within 2 business days and will not pursue good-faith researchers who respect user privacy and avoid service disruption. Confirmed breaches affecting client data are notified to the affected client within 72 hours of detection.
This page supersedes earlier informal statements about ēkotrace's security posture. Material changes are re-versioned and dated.