DOC TYPE: SECURITY CONTROLS · AUDITED WORDING
Enterprise-grade security
for your product data
Your product data, supply chain information, and compliance documents deserve the highest level of protection. EuFSI is built with security at every layer.
Row-Level Security (PostgreSQL RLS)
Every database query is scoped to your organisation through PostgreSQL row-level security policies. Even if application logic is bypassed, the database enforces tenant isolation at the row level.
Encrypted in Transit and at Rest
Traffic between you and the platform is encrypted with TLS 1.3, and data at rest is stored on encrypted infrastructure (AES-256). Public passport pages are served over HTTPS with HSTS.
GDPR Compliance
The platform is built for GDPR from the ground up. Data Processing Agreements are included with every plan. Users can export or erase their personal data at any time through self-service tools.
Tiered Role-Based Access
Access follows a need-to-know model derived from the EU DPP access-rights framework (JRC Annex 8): each economic-operator role (manufacturer, supplier, importer, recycler, market-surveillance authority and more) sees only the data its regulatory basis permits, enforced at the database row level.
Tamper-Evident Audit Trail
Every administrative and data-changing action is written to an append-only audit log that cannot be altered or deleted after the fact: the evidence trail a regulator or auditor can rely on.
Session Authentication
Sessions use short-lived access tokens delivered as httpOnly, secure cookies (never localStorage or any JavaScript-accessible storage), with refresh-token rotation, reuse detection, and server-side revocation on logout.
PRACTICES
Soft Deletes
User-facing data is never hard-deleted. All deletions are soft deletes with timestamped records, ensuring audit trails and the ability to recover data within retention periods.
Parameterised Queries
All database queries use parameterised statements through Prisma ORM, eliminating SQL injection vulnerabilities by design.
Pre-Signed URLs
Files are never proxied through the API server. All file access uses time-limited, pre-signed S3 URLs, reducing attack surface and server load.
COMPLIANCE AND STANDARDS
GDPR
EU General Data Protection Regulation
ESPR
EU Ecodesign for Sustainable Products Regulation
TLS 1.3
Transport Layer Security encryption
AES-256
Advanced Encryption Standard (at rest)
SOC 2
Service Organisation Control (in progress)
GS1
GS1 Digital Link QR standard