Security & privacy at UnitTrack

UnitTrack processes sensitive utility data, so security and privacy are designed in and mapped to accepted standards (NIST SP 800-53 / 800-122 / 800-63B, the ESSnet/Eurostat SDC Handbook). This page is the plain-language overview. Your security reviewer can open the full, control-by-control technical document — and we say plainly what is live today versus on the roadmap.

For analysts and data scientists, the Methods & Formulas document gives every disclosure-control rule and analysis with its formula-as-implemented and primary citation.

Need the short version for procurement? The one-page Security one-pager (PDF) summarizes it all.

---

Encryption at rest

Personally identifiable information is encrypted at the field level with AES-256-GCM, and uploaded source files are stored as ciphertext on disk — plaintext is never written to persistent storage. Each organization's data is encrypted under its own key (per-org envelope encryption: a per-tenant data key wrapped by a master key), and the master key is held outside the database (NIST SP 800-53 SC-28).

Access control & least privilege

Role-based access with separation of duties across five roles. Reading raw PII is its own capability, held only by a dedicated, gated PII Steward — not even an Organization Owner can read raw PII by default, and every reveal is masked-by-default and audited. Two-factor authentication is required for all users (SP 800-63B, AAL2). Access is application-mediated, never direct database access.

Statistical disclosure control

Published aggregates pass disclosure control — minimum-count (k-anonymity) and (n,k)-dominance rules plus complementary suppression, with a residual re-identification risk score — so individuals can't be singled out from released results. Thresholds are configured to meet or beat each jurisdiction's rule.

Verification & testing

We don't ask you to take the math on faith. Every disclosure-control rule and every analysis has been put through an independent, adversarial verification: the formula is re-derived and checked against the actual code and its tests, and each cited source is checked against the primary literature (the standard, the statute, the regulator's decision). Anything the review surfaced was corrected and locked with a regression test so it can't quietly come back. The methods, formulas, thresholds, and their citations are published in full in Methods & Formulas — including honest notes wherever the implementation simplifies the textbook method.

This runs on top of a comprehensive automated test suite (300+ tests covering the analysis engine, disclosure control, encryption, and access control) plus dependency vulnerability scanning on every change (pip-audit in CI). The detailed verification record is available to customers under evaluation on request. (This is our own rigorous internal verification; independent third-party attestation — SOC 2 / external penetration test — is on the roadmap below.)

Audit & accountability

Authentication, configuration changes, PII access, and exports are recorded to an append-only audit log with the actor, timestamp, real client IP, and user agent (SP 800-53 AU-2 / AU-3). A distinct Auditor role has read-only access to the trail.

Multi-tenant isolation

All customer data is organization-scoped; cross-tenant reads and writes are blocked at the query layer, adversarially reviewed with no cross-tenant path found. Platform operators (our own staff) can reach tenant data for support and administration — a standard vendor-operator capability, exercised through the application; privileged configuration changes are recorded to the audit log.

Backups & recovery

The database is backed up on an automated schedule with independent encrypted off-site copies, and the restore procedure is tested — including verifying that encrypted PII is recoverable.

Transport & application hardening

HTTPS/HSTS in production, a Content Security Policy and other response security headers, per-IP rate limiting on public endpoints, per-account brute-force throttling, secure session cookies, upload limits, CSV formula-injection defenses, and a managed database.

Payments

If and when billing is enabled, it is handled by Stripe via hosted checkout; card data never touches our servers, keeping us in PCI DSS SAQ-A scope.

Reporting a vulnerability

Please report security concerns to support@polishcloversolutions.com.

Polish Clover Solutions · Makers of UnitTrack · See also our Privacy Policy, Terms, and Data Processing Addendum.