Trust and security at EnviroAutomate
EnviroAutomate is built for environmental consultancies that handle sensitive site, client, and regulatory data. Your data is hosted in Australia, encrypted in transit and at rest, isolated to your tenant, and operated under a documented information security programme designed to meet ISO 27001 standards.
Security at a glance
Hosting
All client data is hosted in Australia, in AWS Asia Pacific (Sydney), region ap-southeast-2.
Encryption
Traffic is encrypted in transit with TLS 1.2 or higher (HTTP redirects to HTTPS), and data at rest is encrypted with AES-256 across databases, file storage, queues, and backups; keys are managed by AWS KMS.
Access
Multi-factor authentication is mandatory for every platform user; SAML 2.0 SSO is available, including Microsoft Entra ID.
Tenant isolation
Every database query is automatically scoped to the requesting tenant at the application layer, and validated by dedicated automated tests in a suite of over 9,000 that must pass before any deployment.
Threat detection
Continuous threat detection runs across our AWS accounts, with a managed web application firewall in front of the platform.
Backups and recovery
Daily database snapshots and continuous transaction-log backups every 5 minutes, with 35-day retention and point-in-time recovery; target RPO is 5 minutes; target RTO is 60 minutes.
Availability
We target 99.5% uptime, publish the target, and operate to it. We do not offer service credits today; formal SLA commitments are available on request as part of enterprise engagements.
Compliance
Our controls are designed to ISO 27001 standards; we are aligned, not yet certified. See the compliance posture below.
Go deeper
This page is the entry point. Use the links below to go deeper, request the documents your procurement team needs, or contact us directly.
AI data and residency
How EnviroAutomate utilises AI, data residency, tenant scoping, the "no model training on customer data" guarantee, and the shared-responsibility model.
AI Assistant safety summary
A summary of the human-in-the-loop, approval-gated AI posture, useful for internal AI committees.
Technology posture
The tech stack categories, high availability and disaster recovery, backup posture, SLA target, testing posture, and hosting region.
Subprocessors
The current subprocessor list, what data each handles, region, and how we notify clients of changes.
Privacy Policy
The statutory privacy commitment under the Australian Privacy Act 1988.
Data Processing Agreement
EnviroAutomate is finalising its standard Data Processing Agreement with external counsel. The current target for publication is end of October 2026.
Until then, prospects and clients who need a DPA for their procurement process can request the current draft by emailing security@enviroautomate.com. We will also accept and review client-issued DPAs through the same channel.
Documents available on request
The following documents are available on request to evaluators, procurement teams, and security reviewers:
- AI Risk Assessment: the full assessment including residual risk register and shared-responsibility decomposition.
- Technology FAQ: the detailed technology document covering specific services, configurations, and operational practices.
Compliance posture
EnviroAutomate's controls are designed to ISO 27001 standards. We rely on AWS's underlying ISO 27001, SOC 2, and PCI DSS certifications for the infrastructure layer. Formal EnviroAutomate certification is a roadmap item, not a current claim.
We comply with the Australian Privacy Act 1988, including the Notifiable Data Breaches scheme. GDPR, UK GDPR, CCPA, and HIPAA are not currently in scope.
External penetration testing is ongoing as part of our 12-month assurance cycle. Reports are available under NDA via the document request process above.
Security contact
Report a security concern, vulnerability, or policy question to security@enviroautomate.com. We acknowledge reports within 5 business days. We do not currently operate a paid bug bounty and we commit to not pursuing legal action against good-faith researchers acting within this policy.
For privacy matters, contact privacy@enviroautomate.com.