Security
Built for numbers that will be examined.
Where your data is stored, who can see it and how it is protected.
Overview
What your security team will ask.
Where your data is stored
- In India, in Google Cloud’s Mumbai region.
- AI processing uses enterprise providers, which may process outside India.
Who can see it
- Each person sees only the plants and KPIs they are responsible for.
- Your auditor can see everything in scope, but cannot change data.
- Single sign-on is available on the Enterprise plan.
How it is protected
- Each company’s data is kept separate, so one customer can never see another’s.
- Data is encrypted in transit and at rest.
- Every evidence file is fingerprinted, so any change to it is detected.
How the record is kept
- Every key event joins a tamper-evident audit trail.
- Your assessor can verify the trail independently, without relying on Sustano.
- Evidence is kept in locked storage for the retention period you need.
How AI handles your documents
- AI providers may not train on your documents or keep them.
- AI proposes values. People accept or reject every one.
How personal data is treated
- Retention and erasure are designed around India’s DPDP Act.
- Evidence you must keep by law is handled separately from personal data.
The companies that process data for us are listed on the sub-processors page. For personal-data requests and grievances, write to [email protected].
Certifications
SOC 2 and ISO 27001 are in progress.
We are not yet certified under either. Ask us for the current status and our answers to your security questionnaire.
Responsible disclosure
Report a security issue.
Email [email protected] with the subject line “Security report”, the steps to reproduce the issue and the page affected. Our contact details are also in security.txt.
Have a security questionnaire to complete?
Book a demo, or send your questions to [email protected].