Built for a real security review
ESG figures end up in annual reports, filings and assurance statements. These are the controls ESGTrack has today to keep them — and the people who touch them — accountable.
Illustrative screen with sample data.
Access
- Single sign-on
- SAML 2.0 with signed and encrypted assertions, replay protection and single logout — or OpenID Connect.
- Automatic provisioning
- SCIM 2.0 creates, updates and deactivates users and roles from your identity provider.
- Two-step verification
- Time-based codes, required for administrators, with recovery codes.
- Roles and separation of duties
- Roles by pillar and named approvers; nobody approves a figure they entered.
Integrity
- Tamper-evident activity log
- Every change, sign-in and approval in a log where each entry carries the fingerprint of the one before — a chain you can verify.
- Fingerprinted evidence
- Evidence files fingerprinted with SHA-256 when attached and re-verified, so a changed file is noticed.
- Digital signatures, checked
- Signed PDFs — the assurer's statement, board minutes, the filing pack — checked against India's CCA roots, for revocation and for changes made after signing.
- Locked figures
- Filed periods and assured figures are locked; reopening one needs a recorded reason.
Data protection
- Encryption of secrets
- Secrets such as webhook signing keys and backup storage credentials encrypted with AES-256-GCM.
- Encrypted, tested backups
- The database, files and settings in one encrypted file, copied to S3-compatible storage off the server, with restore drills that prove it loads.
- A strict content security policy
- Every page tells browsers which scripts may run; anything else is refused and reported.
- Your data, always
- Full export at any time; account deletion on request; a data processing agreement.
Privacy
- DPDP Act privacy centre
- A personal-data inventory, requests from data principals with their due dates, a breach register with the 72-hour clock, and retention applied every day.
- AI only when switched on
- With the provider you choose, personal data removed before sending, and a monthly budget.
- Access you grant, and can end
- Consultants and assurers see only what each company gives them, for as long as it chooses.
Documents and status
The privacy policy, terms of service and data processing agreement are published here; current and past incidents are on the system status page.
Questions about security
Who can see our data?
People in your company, by the roles you give them; consultants and assurance providers only with the access you grant, limited to what you choose and — for assurers — to the periods of their engagement. Platform administrators work under two-step verification and their actions are logged separately.
Is AI used on our data?
Only if an administrator switches it on. It then uses the provider you choose; personal data such as e-mail addresses, phone numbers, PAN and Aadhaar is removed before anything is sent, a monthly budget caps the cost, and every suggestion waits for a person to accept it.
Can we get our data out?
Yes, at any time: every figure with its evidence, every report and the full audit trail. Account deletion is available on request.
Do you complete security questionnaires?
Yes — ask for one as part of a demo or an enterprise discussion, and we will answer it for the controls described here.
Bring your security questions
We will go through access, data protection and our answers to your questionnaire in an enterprise discussion.