Your records, protected like records.

Customer data is stored and processed in the United States, on infrastructure run by Amazon Web Services (AWS). Files are kept in Amazon S3 in the same region.

Every company that processes customer data for us is on the sub-processor list, with what it does and where. We give 30 days notice before adding one.

Every record belongs to one company. A request is tied to that company before it touches any data, and the application refuses to read or write without knowing whose data it is. Your clients reach the portal through your company and see only their own records.

Files follow the same rule: every stored file sits under its company's own prefix, and the storage layer will not open one without that company in context. Automated tests try to cross from one company to another on every change.

In transit. Every connection is HTTPS over TLS. Plain HTTP is redirected, and browsers are told never to fall back to it.

At rest. Databases, backups and file storage are encrypted at rest. Credentials you give us for other systems, such as your EPA RCRAInfo API key, are also encrypted inside the application, so they can't be read from a copy of the database.

Passwords are stored only as one-way bcrypt hashes. Every user has a role, and every screen and action checks it. Your clients see only their own events, manifests and invoices in the portal.

Mercovi staff reach customer data only to support you. That access is limited to the people who need it, reviewed regularly, and logged.

Every change runs automated security checks before it can ship: static analysis of the code, a check of every dependency against known vulnerabilities, and a scan for leaked secrets. Hosts are patched and scanned on a schedule.

We don't start with a penetration test. We first audit production across thirteen layers: authentication, tenant isolation, the database, application security, secrets, hosting, deployment, monitoring, scaling, backups and recovery, incident readiness, third-party integrations, and the data lifecycle. We fix what that finds, then an independent firm tries to break in. Then we audit again to confirm the fixes held.

Production audit: not yet performed; the first is completed before any customer's data goes into production. External penetration test: not yet performed; the first is completed before any customer's data goes into production. The audit scorecard and the test's executive summary are available to customers and prospects under NDA.

Databases are backed up continuously and copied off-site, encrypted, and kept for 35 days. Stored files are versioned.

We restore from backup on a schedule to prove it works, and we can restore one company's data without touching anyone else's. Our recovery objectives are 8 hours to restore service and no more than 1 hour of data. The service level agreement sets out the commitments.

We maintain a written incident response plan covering detection, containment, recovery, notification and review, and we rehearse it in tabletop exercises.

If an incident affects your data, we tell you within 72 hours: what happened, what was affected and what we are doing about it. A summary of the plan is available on request.

SOC 2 status: a SOC 2 examination is underway with an independent, licensed CPA firm; no report has been issued yet. When the report is issued, customers and prospects can request it under NDA.

Your security team can request our security exhibit, data processing addendum, sub-processor list and insurance certificate. All four are on the legal page.

Your records are yours. We process them only to run the service for you, and we never sell them or use them for advertising. You can export them at any time in a machine-readable format.

When a subscription ends, you have 30 days to export. After that the data is deleted within 30 days, including from backups as they expire. See the privacy policy and the data processing addendum.

If you think you've found a security problem in Mercovi, email security@mercovi.com with what you found and the steps to reproduce it. We will acknowledge the report, keep you updated while we fix it, and credit you if you'd like.

We won't take legal action over good-faith research that follows these rules: test only against an account you own, don't access, change or keep other people's data beyond what you need to show the problem, don't degrade the service for anyone else, and give us reasonable time to fix the problem before you disclose it. Social engineering, physical attacks and denial of service are out of scope.