Trust

Security

Last updated 30 August 2026

Energy Connect carries commercially sensitive data: what you pay for fuel, who you buy it from, where you deliver it, and what your margin is. A broker and the carrier hauling for them use the same platform, and neither should see the other's economics. Separation is not a feature we added — it is how the system is built.

Tenant isolation

Every company is a separate tenant, and isolation is enforced in the data layer rather than left to each query to remember.

The authenticated user's company is placed in request-scoped storage by middleware, and a Prisma layer reads it and injects the matching WHERE clause into every query automatically. A developer cannot forget to scope a query, because scoping does not happen at the call site.

The narrow cases that legitimately cross companies — a carrier seeing the pickup terminal on a load they have accepted, for example — are explicit, individually reviewed, and recorded. Everything else is scoped by default.

Access control

• Role-based permissions. Every route declares the role it requires. Promotion is capped at the acting user's own level, so an account cannot grant more than it holds.
• Company-type gating. Supplier-only, carrier-only and staff-only surfaces are separated at the router, not hidden in the interface.
• Disclosure rules by role. Carriers do not see end-customer identity on brokered work, and bid amounts are not visible between competing carriers. These are server-side rules, not UI filtering.
• Scoped API keys. Every public API key carries explicit scopes, and a route refuses a key without the scope it needs.

Authentication

• Passwords are hashed with bcrypt. They are never stored or logged in plain text and cannot be read back by anyone, including us.
• Multi-factor authentication is TOTP-based and can be required company-wide by an administrator.
• Step-up MFA guards destructive administrative actions — deactivating a company, resetting another user's MFA, impersonation. These need a fresh single-use token that is bound to the calling user, expires in five minutes, and is destroyed on first use, so a captured token cannot be replayed. An account without MFA enrolled cannot mint one, and therefore cannot perform these actions at all.
• Single sign-on. Identity-provider tokens are verified cryptographically against the provider's rotating signing keys and checked against the expected audience. SSO can be enforced company-wide.
• Session policy is yours to set. Administrators control session timeout, automatic logout, login alerts, and password expiry for their own company.

Audit trail

Every state-changing operation records who did it, what changed, when, and the origin of the request. Entries are written to a queryable audit table and emitted to the log pipeline, so the record survives independently of the application database.

Audit entries are append-only from the application's point of view. There is no interface for editing or deleting them.

API and integrations

• Keys are shown once at issuance and stored hashed. A lost key is replaced, not recovered.
• Every write requires an idempotency key. A retry with the same key and body replays the original response instead of repeating the side effect, so a network failure cannot double-dispatch a load or double-charge an invoice.
• Rate limits apply per key, with a burst ceiling and a monthly cap, and every response carries the current state in standard headers.
• IP allowlisting is available for keys that should only be usable from known infrastructure.
• Webhooks are signed with HMAC-SHA256 over the timestamp and the raw request body. Verify the signature and reject anything older than five minutes, and a replayed or forged delivery cannot be mistaken for a real one. Duplicate deliveries are detected and discarded.

Transport and infrastructure

• All traffic is served over TLS. HTTP Strict Transport Security is asserted, so a browser that has seen the site once will refuse to downgrade.
• Data is encrypted at rest by the managed database platform.
• Responses carry X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a restrictive Referrer-Policy, and a Permissions-Policy that denies geolocation, microphone and camera.
• Production and staging run in separate cloud projects with separate credentials and separate databases.
• Request payloads are validated against a schema at the boundary and rejected if they do not match. Unknown fields are refused rather than silently ignored.

Data ownership

Your operational data is yours. Orders, invoices, delivery tickets, pricing and documents are readable through the public API under the scopes you grant, so you can export or mirror them into your own systems at any time without asking us.

We do not sell your operational data, and we do not use one company's commercial data to inform another's pricing. How personal information is handled, including your rights over it, is covered in the privacy policy.

Reporting a vulnerability

If you believe you have found a security issue, email sales@energyconnecter.ai with enough detail to reproduce it. Please give us a reasonable window to investigate and remediate before disclosing publicly. We will confirm receipt and keep you updated on the fix.

Certifications

Energy Connect is built to the control expectations of SOC 2 and ISO 27001 — audit logging, access control, tenant separation and encryption are implemented accordingly. We do not claim to hold either certification on this page. For our current status, or to have a security questionnaire completed as part of a vendor review, contact sales@energyconnecter.ai.