Security and tenancy
Your building data stays yours, and stays apart
Consumption data shows when your buildings are occupied and when a site is empty. Radr keeps each customer’s data separate in the datastore itself, not only in the application code.
What does that mean in practice?
- Isolation in the datastore. Row-level security on tenant-scoped tables. No tenant context means no rows, not all rows.
- Ownership checked per request. Every ID in a request is verified against the caller’s tenancy before it is read or written. Another tenant’s ID is refused, not answered with an empty result.
- Role-gated writes. Certifying a baseline, changing a boundary, tariff or emissions factor needs a role that carries it. Read access never implies write access.
- Encryption. In transit between services, and at rest for stored data and backups.
- Audit trail. Who certified or superseded a baseline, when, and what changed.
- Export and deletion. Your measured data can be exported in full at interval grain, and deleted on instruction, with scope and timing confirmed in writing.
How customer data is kept apartDiagram
Status
What do you not claim?
- No SOC 2 report, ISO 27001 certificate or third-party penetration-test attestation is asserted here.
- Nothing listed above is a roadmap written in the present tense.
- A screen that hides a figure is not a security boundary. The boundary is where the bytes stop.
Our certification status and any current assurance activity are available on request, including where the answer is “not yet”. We will also answer a security questionnaire and describe hosting and data residency for your region.
Related: how data connects (a gateway on site forwards outward; Radr reads points rather than driving them).
Send us your security questionnaire
We will complete it and state our current position plainly.