EcoService Pro — Security & Compliance Audit
Owner: EcoPowerHub AI LLC · Columbia, MD, USA Last updated: August 2, 2026 Status: Phase 2 (Governance) in progress
This document is the single entry point for auditors, prospects, and the internal security team. It links to the live policies, risk register, and vendor assessments that make up our compliance program.
1. Technical safeguards (Phase 1 — complete)
| Control | Evidence |
|---|---|
| Row-Level Security on all tenant tables | supabase/tests/roles_and_rls.sql (CI-enforced) |
| Strong-password + HIBP leaked-password check | Supabase Auth config |
| MFA (TOTP) | Available to all users — /team → Account security |
| Comprehensive audit logging | audit_logs table, src/lib/audit.server.ts |
| Encryption at rest & in transit | Supabase (AES-256 at rest, TLS 1.2+ in transit) |
| Input validation (Zod) on every server fn | src/lib/*.functions.ts |
| Rate limiting on public endpoints | rate_limit_buckets + middleware |
| Security event dashboard | /security (owners only) |
| Automated dependency vulnerability scanning | .github/workflows/dependency-scan.yml (weekly + on PR) |
| Static analysis (CodeQL) & secret scanning | .github/workflows/codeql.yml, .github/workflows/secret-scan.yml |
| Stripe webhook idempotency | stripe_webhook_events ledger, src/lib/stripe-idempotency.server.ts |
| Audit write-failure alerting | High-severity audit_write_failed event raised from src/lib/audit.server.ts |
| Backups & restore | Restore rehearsal runbook — first drill pending |
2. Governance policies (Phase 2)
All policies are version-controlled and reviewed annually. Drafts were co-authored with our internal ComplianceGuard AI reviewer and approved by the CEO.
3. Risk management
- Risk Register — 12 tracked risks with likelihood, impact, owner, and mitigation status.
4. Vendor / sub-processor risk
- Vendor Risk Assessment Template
- Completed vendor assessments — Supabase, Stripe, Cloudflare, Lovable AI Gateway, PostHog, Sentry, Resend, DFINITY (IC).
5. Legal & user-facing
6. Contact
Security disclosures & compliance questions: engmartin@ecopowerhub.ai
EcoService OS information security policy — scope, roles, control objectives, and change management for the platform.
Access control policy for EcoService OS — least privilege, role assignment, MFA, and review cadence for production access.
Engineering-facing data privacy policy for EcoService OS — how personal data is classified, handled, retained, and deleted.
Incident response plan for EcoService OS — severity levels, on-call escalation, containment, notification, and post-incident review.
EcoService OS risk register — tracked risks with likelihood, impact, owner, and current mitigation status.
Backup and restore rehearsal runbook for EcoService OS — drill scope, restore steps, and evidence captured after each rehearsal.
Completed vendor risk assessments for the subprocessors EcoService OS relies on, with residual risk scores and review dates.
The vendor risk assessment template EcoService OS uses to review every new subprocessor before approval.
Every policy above is published on this site. Material changes are reviewed by the Security Lead and approved by the CEO.