POLICY
Trust and Security at Envire
Update Date:
Envire helps venues and event teams track and report energy, waste and emissions data. This page explains how we protect that data and where our independent assurance stands today.
Independent assurance: Envire does not currently hold a SOC 1 or SOC 2 report or an ISO/IEC 27001 certification. We are preparing for SOC 2.
Security questions: privacy@envire.ai
Last reviewed: November 11, 2026
Our approach to security
We are a small team and we keep our security program practical. We limit who can see customer data, we fix the problems we find, and we describe only what we can show. Where something is still being built, we say so.
Application access
Envire uses password hashing and signed, expiring authentication tokens. Access and refresh tokens have separate purposes and are bound to the user's current password credentials. Password changes invalidate previously issued tokens, and disabled accounts cannot refresh their access.
Company-scoped authorization restricts ordinary users to their company's resources. Envire platform administrators have privileged cross-company access for administration. Company scoping does not mean that Envire administrators cannot access customer data.
Account creation requires an authenticated platform administrator. Password-recovery requests do not return reset credentials in application responses, and password-setup links are time-limited.
Public application authentication exemptions are defined explicitly by request method and route, rather than by matching words in a URL.
Web application protections
The web application includes server-side session handling, HttpOnly and SameSite cookie settings, CSRF validation, and browser security headers. These controls reduce common web-application risks. They are not a guarantee against every attack.
Report data protections
Report notes are rendered as text rather than executable HTML, with line breaks preserved. Embedded chart data is encoded so that it cannot end its script block.
Selected authentication, report-generation and shared HTTP logging paths omit credential-bearing URLs and report payloads. These safeguards reduce sensitive-data exposure. They do not mean that all application data is absent from every log.
Hosting and infrastructure
Envire is hosted on Amazon Web Services (AWS) in the United States (Oregon region). Our AWS environment is organized as multiple separate accounts, managed with AWS's standard governance tooling. Security monitoring, audit logs, identity administration and software deployment each run in their own dedicated account, separate from the application. Development and production use separate servers, databases and file storage.
Infrastructure access
Staff sign in to AWS through our company identity provider (Microsoft Entra ID) using single sign-on. Access is role-based and granted through group membership. When someone is removed from our identity provider, their AWS access is disabled automatically. We do not use long-lived individual AWS user credentials. The most privileged AWS account credentials are centrally controlled, protected with multi-factor authentication, and not used for day-to-day work. Changes to those credentials require approval from two people.
Infrastructure monitoring and data protection
Activity across our AWS environment is recorded in tamper-evident audit logs. These logs are stored in a separate account and kept for at least one year. AWS security services continuously monitor for threats, check our configuration against industry security benchmarks, and scan our software for known vulnerabilities.
Customer data stored in AWS is encrypted at rest. This covers the database, uploaded files and application logs. Connections to the application are encrypted in transit: plain-HTTP requests are redirected to HTTPS. Application credentials are kept in a dedicated secrets store, not in source code. The database is not reachable from the internet. Production web traffic passes through a web application firewall, and production database backups are taken automatically and kept for 35 days.
Customer data and privacy
Envire processes the account, venue, event and utility information needed for enabled workflows. Our core product does not require personal information. The closest data is business email addresses, which we use to set up customer accounts and for marketing. Uploaded files and reports can still contain personal or commercially sensitive information, so data-processing details depend on the services and integrations each customer uses. We do not sell personal information.
AI and your data. Envire uses AI services from Amazon Web Services to extract data from uploaded documents such as invoices and PDFs. We do not currently train AI models on customer data. If we develop our own models in the future, we will train on customer data only if the customer has agreed in advance in writing, and customers can withdraw that agreement for future training.
Retention and deletion. We keep customer data for the term of the customer agreement and delete or return it on request or when the agreement ends.
Customers evaluating Envire can ask about their proposed data flows, integrations and security requirements at privacy@envire.ai.
Read more: our Privacy Policy, Cookie Policy, and Terms of Service.
Subprocessors
We use a limited number of service providers to run Envire. They are bound by confidentiality and data protection terms. Our Subprocessors page lists each one, what it does and where. Customers with a Data Processing Addendum are told in advance about material changes.
Independent assurance
Envire does not currently hold a SOC 1 or SOC 2 report or an ISO/IEC 27001 certification. We are preparing for SOC 2 and can share our plan on request. We do not display compliance badges until a report or certification has been issued.
SOC 2 is an independent examination of a company's controls, with a report issued by a licensed CPA firm. ISO/IEC 27001 certifies a scoped information security management system. SOC 1 covers controls relevant to customers' financial reporting.
Our application runs on AWS. AWS maintains its own independent assurance reports, and those cover AWS's responsibilities, not Envire's own controls.
Security reviews
We welcome customer security questionnaires and requests for supporting information. Approved, non-public materials can be shared through an agreed restricted review process, under NDA where appropriate. Write to privacy@envire.ai and tell us what your team needs.
Reporting a security issue
If you believe you have found a security issue in Envire, or you suspect an incident, please email privacy@envire.ai with what you found and how to reproduce it. Please do not access other customers' data or disrupt the service while investigating.
Documents
Public: Privacy Policy, Cookie Policy, Security Policy.
On request: Data Processing Addendum (legal@envire.ai) and security questionnaire answers (privacy@envire.ai).
Contact
Security and incident reports: privacy@envire.ai
Privacy requests: privacy@envire.ai
Legal and Data Processing Agreements: legal@envire.ai
General support: support@envire.ai
UpCycleo, Inc., doing business as Envire
525 S Hewitt St, Los Angeles, CA 90013
