POLICY
Information Security Policy
Update Date:
UpCycleo, Inc. (d/b/a Envire)
Version 1.0
Effective: November 12, 2026
Next review: November 2027
Purpose
This policy sets out how Envire protects the confidentiality, integrity and availability of company information and of the data our customers entrust to us.
Scope
This policy applies to everyone who works for Envire, including founders, employees, interns, contractors and advisors, and to the systems used to deliver the Envire platform, including our cloud environment, source code repositories, company accounts and devices used for work.
Security objectives
Keep customer data accessible only to the people who need it, and protected in transit and at rest.
Detect, contain and learn from security incidents.
Change production systems in a controlled way.
Choose and review vendors with care.
Be honest with customers about our security practices and about any incident that affects them.
Roles and responsibilities
Policy owner (Chief Executive Officer): approves this policy, owns customer and legal communication, and approves exceptions together with the technical owner.
Technical control owner (Chief Technology Officer): owns application and engineering controls, change management, vulnerability handling and incident response.
Infrastructure administrator (contractor): operates our cloud environment under the access rules in this policy.
All personnel: follow this policy and report incidents and suspicious activity right away.
Data classification and handling
Envire uses three classes of information.
Restricted: customer data (venue, event and utility data, uploaded files and generated reports), credentials, secrets, encryption keys and security logs. Access is limited to named people with a business need.
Internal: business plans, financials, source code, internal documents and business contact details such as work email addresses.
Public: website content, published policies and marketing material.
The core Envire product is built to process venue and event sustainability data and does not require customers to submit sensitive personal information. Restricted data must not be placed in personal accounts, public tools or AI services that have not been approved under the vendor rules below. Customer data is not used to train AI models unless the customer has agreed in advance in writing.
Customer data is kept for the term of the customer agreement and deleted or returned on request or when the agreement ends. Production database backups are kept for 35 days.
Access control
Least privilege. People receive the minimum access needed for their role. Access to customer data in production is limited to named staff.
Single sign-on for infrastructure. Staff access to our cloud environment is through our identity provider using single sign-on and role-based group membership. We do not use long-lived individual cloud user credentials. When a person is removed from the identity provider, their cloud access is disabled.
Privileged credentials. The most privileged cloud account credentials are centrally controlled, protected with multi-factor authentication and not used for day-to-day work. Changes to them require approval from two people, so security does not depend on any one person.
Accounts and passwords. Each person signs in with their own account. Shared mailboxes and distribution lists used for administration and recovery have named owners and are reviewed. Passwords are kept in a password manager.
Customer accounts. In the Envire platform, users are limited to their own company's data. Envire platform administrators have privileged cross-company access for administration. Company scoping does not mean Envire administrators cannot access customer data, and they use that access only for legitimate business purposes.
Onboarding and offboarding. Access is approved when someone joins and removed when they leave or stop working with us.
Access reviews. Access to production, source code, the identity provider and key business tools is reviewed periodically.
Encryption and secrets
Customer data stored in our cloud environment (database, uploaded files and application logs) is encrypted at rest.
Connections to the application are encrypted in transit. Plain HTTP requests are redirected to HTTPS.
Application credentials and secrets are kept in a dedicated secrets store, not in source code.
Logging, monitoring and backups
Activity across our cloud environment is recorded in audit logs stored in a separate account and kept for at least one year.
Cloud security services monitor for threats, check configuration against industry benchmarks and scan software for known vulnerabilities.
Production web traffic passes through a web application firewall. The production database is not reachable from the internet.
Production database backups are taken automatically and kept for 35 days.
Vendors, subprocessors and AI services
Before a vendor receives customer data or access to our systems, we review its security and privacy terms.
Vendors that process customer data are listed on our Subprocessors page.
Customer data is sent to an AI service only if the service is approved, the provider is prohibited from training on the data, and the use is covered by our customer agreement. Customer data is used to train or improve Envire models only where the customer has agreed in advance and in writing.
Vendors are reviewed periodically.
Secure development and change management
Code is kept in a managed repository. Changes to production code are reviewed and tested before release where practical.
Development and production use separate servers, databases and file storage.
Vulnerabilities we identify are triaged and fixed by severity, with critical and high findings first.
Incident response
Anyone who suspects a security incident, lost device or exposed credential reports it immediately to privacy@envire.ai.
The technical owner leads the response: confirm and classify the incident, contain it, preserve evidence, fix the cause and recover. The policy owner decides on customer and legal notification.
Affected customers are told without undue delay once we confirm that their data is affected, in line with contract and law.
Significant incidents are followed by a written review and follow-up actions.
People
Everyone in scope reads and acknowledges this policy when they join and every year.
Personnel are bound by confidentiality obligations before accessing Restricted data.
Company systems are used for business purposes, and devices used for work are kept patched and locked.
Exceptions and enforcement
Exceptions to this policy must be approved in writing by the policy owner and technical owner and are limited in time. Violations may lead to removal of access and, for employees and contractors, other action up to ending the relationship.
Review
This policy is reviewed at least once a year, and after any major change to our product, infrastructure or after a serious incident.
Contact
Questions about this policy or security reports: privacy@envire.ai
