Program
Program Overview
How EcoService OS runs its security and compliance program — controls, evidence, and the policies that govern customer data.
EcoService Pro — Security & Compliance Audit
Owner: EcoPowerHub AI LLC · Columbia, MD, USA Last updated: August 2, 2026 Status: Phase 2 (Governance) in progress
This document is the single entry point for auditors, prospects, and the internal security team. It links to the live policies, risk register, and vendor assessments that make up our compliance program.
1. Technical safeguards (Phase 1 — complete)
| Control | Evidence |
|---|---|
| Row-Level Security on all tenant tables | supabase/tests/roles_and_rls.sql (CI-enforced) |
| Strong-password + HIBP leaked-password check | Supabase Auth config |
| MFA (TOTP) | Available to all users — /team → Account security |
| Comprehensive audit logging | audit_logs table, src/lib/audit.server.ts |
| Encryption at rest & in transit | Supabase (AES-256 at rest, TLS 1.2+ in transit) |
| Input validation (Zod) on every server fn | src/lib/*.functions.ts |
| Rate limiting on public endpoints | rate_limit_buckets + middleware |
| Security event dashboard | /security (owners only) |
| Automated dependency vulnerability scanning | .github/workflows/dependency-scan.yml (weekly + on PR) |
| Static analysis (CodeQL) & secret scanning | .github/workflows/codeql.yml, .github/workflows/secret-scan.yml |
| Stripe webhook idempotency | stripe_webhook_events ledger, src/lib/stripe-idempotency.server.ts |
| Audit write-failure alerting | High-severity audit_write_failed event raised from src/lib/audit.server.ts |
| Backups & restore | Restore rehearsal runbook — first drill pending |
2. Governance policies (Phase 2)
All policies are version-controlled and reviewed annually. Drafts were co-authored with our internal ComplianceGuard AI reviewer and approved by the CEO.
3. Risk management
- Risk Register — 12 tracked risks with likelihood, impact, owner, and mitigation status.
4. Vendor / sub-processor risk
- Vendor Risk Assessment Template
- Completed vendor assessments — Supabase, Stripe, Cloudflare, Lovable AI Gateway, PostHog, Sentry, Resend, DFINITY (IC).
5. Legal & user-facing
6. Contact
Security disclosures & compliance questions: engmartin@ecopowerhub.ai