Security and ISO Certification

‍

At CarbonChain, we understand the critical importance of trust and security in order to be your carbon accounting platform. That's why, from our very inception, we have made the development of a secure platform and product a priority.

Trust, but verify

In 2024, CarbonChain was certified by Isoqar as ISO 27001:2022 compliant. This was an opportunity for us to show an external auditor our Information Security Management System (ISMS), how we approach and mitigate risk, and the operational controls that allow us to operate a secure company.

We were proud to complete this process with no findings; this means zero non-conformances to the ISO 27001 specification were identified and no opportunities for improvement were flagged. The certificate is valid until 31^st July 2027; until then, CarbonChain will undertake a stringent process for ongoing review.

Protecting our customers' data

Protecting our customer data is critical to build a growing and sustainable business that enables companies to report on their Carbon emissions and work towards reducing them. We operate CarbonChain with the following processes:

• All data is encrypted at rest and in-transit;
• Customer data is logically separated to maintain confidentiality;‍
• We abide by the principle of least privilege. Our product and cloud environment are configured to manage access to data via roles and, by default, assume no access unless specifically granted;
• Access to our product is typically via SAML-based SSO (Security Assertion Markup Language-based single sign-on). This means we can leverage your Identity infrastructure to define access to your data and place some of the data controls in your hands;
• The ability to audit our systems is important for us and our customers and therefore access is logged and retained.

Secure SDLC

An effective secure software development lifecycle (Secure SDLC) is a critical component in building resilient and trustworthy software solutions. By integrating security into every phase of the development process, from initial design to deployment and maintenance, CarbonChain proactively identifies and mitigates vulnerabilities before they become exploitable weaknesses.

A key component of this approach is leveraging frameworks like the OWASP Top 10, which provides a comprehensive list of the most critical security risks to web applications. By addressing these risks during development, organizations can significantly reduce the likelihood of successful attacks. 

Additionally, a robust Secure SDLC includes a commitment to regular patching of software versions. As new vulnerabilities are discovered, we rely on a variety of external signals to keep us informed so that we can rapidly patch and deploy our software ahead of industry standards.

Ongoing adaptation and quarterly processes

Ensuring that there is ongoing value to our Information Security Management Systems means regular review and development of our risk and operational controls. As a result, CarbonChain has committed to a series of actions every quarter to ensure that our systems and controls grow and adapt ahead of our company growth.