Security and data handling

What is actually in place, and what is not yet.

A utility security review will find whatever a vendor left out, so here it is up front. Everything in the first section is running in production today and was checked in the code before this page was written. Everything in the last section is not done, with a date or a trigger. GridProjeX is an early product built by a small team, and pretending otherwise would waste your reviewer’s time and ours.

In place today

The parts a reviewer asks about first.

Tenant isolation enforced by the database, not the applicationEvery tenant scoped table carries a PostgreSQL row level security policy keyed to the current tenant, and the application connects as a role that cannot bypass it. A query that forgets a tenant filter returns nothing rather than another company’s data. Sixteen tables are covered and a test asserts it on every build.
Append only audit trail with a hash chainEvery consequential action writes a ledger event, and the database assigns the sequence and links each event to the hash of the one before it inside the same transaction. Callers cannot supply those fields. A deleted or altered event breaks the chain, and the restore drill verifies the chain for every tenant.
Secrets encrypted at rest with AES-256-GCMWebhook secrets and the AI key a company loads are encrypted with a server master key, with the tenant id bound in as associated data so one tenant’s ciphertext cannot be decrypted in another tenant’s context. The key is never returned by any endpoint, only its last four characters.
Passwords hashed with Argon2id64 MB memory cost, three iterations. Sessions expire in twelve hours and are revocable individually. A password reset link is single use, valid one hour, and signs out every other session on that account. Changing a password revokes the others.
Documents stored unchanged and content addressedThe original bytes are kept as uploaded, with a SHA-256 recorded per version. Versions are immutable, a re upload of identical bytes is recognized rather than duplicated, and the restore drill verifies every stored file against its recorded hash.
Restores proved on a schedule, not assumedA drill takes a fresh backup, restores it into a scratch database, unpacks storage, starts a second instance from the restored data, then checks row counts against live across twenty one tables, the ledger chain for every tenant, every document file and hash, a login, and a document download. Thirteen checks. The last run passed thirteen of thirteen.
Your AI account, your terms, or none at allA company loads its own OpenAI or Anthropic key, so document reading happens under your contract, your model choice, and your retention terms, and can be pointed at a private endpoint. Turn AI off and every screen still works. No document is used to train anything.
No public signup, and least privilege by roleAccounts exist only by invitation from an owner. Permissions are granted per role per company and checked on every endpoint, and a platform administrator joining a tenant is written to that tenant’s ledger.
Transport and hosting, and who is responsible for whatHTTPS everywhere with certificates renewed automatically. Single region United States hosting on a dedicated instance, with the database not exposed to the internet and nightly backups held off the application host. The infrastructure runs on DigitalOcean, which holds SOC 2 Type II, SOC 3 Type II, ISO 27001, and a CSA STAR Level 1 listing. That covers their facilities, hardware, and hypervisor. Everything above it, meaning our configuration, access control, encryption choices, logging, and application code, is ours to prove and we do not claim their attestation as our own.
Not done yet

Stated plainly, with what triggers each one.

None of the following exists today. If your review requires any of it, say so at the first meeting and we will tell you honestly whether the timeline works, rather than discovering it in month three.

SOC 2 Type IINot held. A Type II report needs a minimum observation window, so from a standing start it is roughly six to nine months and a meaningful cost. We will start it against a signed pilot rather than speculatively, and we will say where we are in the process rather than implying we are further along.
Independent penetration testNot yet performed. This is the first thing we will buy, because it is the highest value per dollar for a reviewer and it does not require a twelve month window.
Single sign onNot built. SAML and OIDC are on the roadmap for the utility workspace, since a utility will not hand out separate passwords to reviewers.
Key person riskGridProjeX is built by a very small team. That is a legitimate procurement concern and we will not argue it away. What we offer against it: your data is exportable in full at any time, the ledger is exportable, documents are stored as plain original files, and there is no proprietary format to be trapped in. Source escrow can be discussed.
Questionnaires. We will complete the NATF Energy Sector Supply Chain Risk Questionnaire, a CSA CAIQ, a SIG Lite, or your own security exhibit, and we will answer “no” where the answer is no. If your procurement runs through a Florida cooperative purchasing path or a joint agency, tell us which one and we will work inside it.
Against the standard you will hold us to

The EEI Model Procurement Contract Language, clause by clause.

Most utility security exhibits are built from the Edison Electric Institute model contract language, version 4.0, June 2026, including its new cloud and artificial intelligence sections. Here is where we stand against the clauses that apply to a cloud product like this one. Met means it is true of the running system today.

ClauseWhat it requiresWhere we stand
Cloud data residencyInfrastructure hosting or transmitting utility data must be located in the United StatesMet Single region United States hosting
Support personnelAll personnel supporting the cloud infrastructure must be in the United States and background checkedMet All personnel in Florida. No offshore development or support, and none planned
EncryptionUtility data encrypted in transit and at rest, using FIPS 140-2 approved methodsPartial TLS in transit and database connections; AES-256-GCM for stored credentials; Argon2id for passwords. Full volume encryption at rest is inherited from the hosting provider rather than applied by us, and we will say exactly that in a questionnaire rather than claim more
Access management controlThe utility keeps exclusive control of access to its own dataMet Roles and members are administered by the tenant. A platform administrator joining a tenant is written to that tenant’s own ledger
Deletion and proofDocumented ability to completely delete utility data and demonstrate it is inaccessibleMet Hard delete in dependency order with storage objects removed, already exercised and verified
AI: no training on your dataUtility data must not be used as training data without written consentMet You load your own model key, so reading runs under your provider contract and retention terms. Nothing is used to train anything
AI: named accountable executiveA single senior executive responsible for secure use of AIMet Named in the agreement
Incident notificationImmediate written notice on knowledge or reasonable belief of a security incident; 24 hours for an agency filingMet We will sign a 24 hour notification commitment
Change of ownershipNotice of a material change in ownership of the vendorMet We will sign it
Vulnerability disclosureSummary documentation within 30 days, consistent with ISO/IEC 29147 and 30111Partial We will commit to the 30 day window. A formal published disclosure program is not yet in place
Software bill of materialsAn SBOM for the delivered softwarePartial Dependencies are pinned and auditable, but we do not yet publish a signed SBOM
Customer held encryption keyOption for the utility to hold an encryption keyNot yet Secrets use a server master key today. Customer managed keys are an architecture change we will scope against a signed pilot
Single sign onSAML 2.0 federation to the utility identity providerNot yet On the roadmap for the reviewer workspace, and we will not ask your reviewers to keep separate passwords
Annual independent penetration testExternal and authenticated internal perspectives, at vendor expenseNot yet First security spend we intend to make
SOC 2 Type II or ISO 27001Independent attestation of the control environmentNot yet A Type II report needs a multi month observation window. We will start it against a signed pilot, not speculatively
Audited financial statementsCommonly required for proposal responsivenessNot yet We are a small company and do not have audited statements. Ask us early if your process requires them

Clause text from the Edison Electric Institute Model Procurement Contract Language, version 4.0, June 2026. We are not affiliated with EEI; we use their model because your procurement team probably does.

What does not apply

Three regimes your template may name that do not reach this product.

Security exhibits get reused, so interconnection intake software often arrives carrying requirements written for grid control systems. We would rather say this plainly at the start than bill anyone for the months it takes to discover.

NERC CIPCIP applies to Bulk Electric System Cyber Assets, and the governing test is whether losing the asset degrades the Bulk Electric System within fifteen minutes. Interconnection application intake is a distribution level business workflow on a timescale of weeks. It is not a BES Cyber System by voltage tier, by function, or by the fifteen minute test. CIP-013 also places no obligation on a supplier at all; it obliges the registered entity to ask. The one real exposure is BES Cyber System Information: if an application package carries protection settings or network topology for BES connected equipment, that is governed by CIP-011 and we will handle it under your rules.
NIST 800-171 and CMMCBoth attach through a federal contract clause. Neither a municipal utility nor a cooperative can issue one, and interconnection data is neither Federal Contract Information nor Controlled Unclassified Information. Federal grant funding does not trigger it either: a commercial software vendor is a contractor under the Uniform Guidance, and that flow down set contains no cybersecurity clause. CMMC is a Department of War program and its later phases are currently suspended. If a vendor in this category advertises 800-171, ask them which federal contract obliges it.
GovRAMP, formerly StateRAMPNot required by Florida law. The state cybersecurity statute covers state agencies, and the local government statute contains no vendor mandate at all. Some Florida entities participate voluntarily and can name it in a solicitation. If yours does, tell us and we will price the Snapshot tier honestly rather than pretend we already hold it.
What we will engage with insteadThe NATF Energy Sector Supply Chain Risk Questionnaire, currently version 7.0, which is what your supply chain team most likely owns, and the security exhibit attached to your own solicitation. Both get real answers, including the negative ones.
Data handling

Whose data it is, and what leaves.

The data is yoursDocuments are stored unchanged, the ledger and the record are exportable, and nothing is shared with a homeowner, an installer, or any third party unless your team chooses to share it.
What leaves the serverOnly two things. A document sent to the AI provider whose key you loaded, when someone presses Read with AI. And a password reset email. Nothing else is sent anywhere. There is no analytics vendor inside the console and no advertising or tracking pixel.
Public recordsWe understand that a vendor holding records for a Florida public agency can pull those records into Chapter 119 obligations. We will take the public records clause in your agreement and we will produce records on request in a usable format rather than arguing about it.
Homeowner dataThe homeowner view carries status in plain language and nothing more. It contains no pricing, no internal notes, and no other customer. It is shared by a link the installer controls and can revoke.

Questions from a security reviewer are welcome before any commercial conversation. Reach us through CivyxIQ. Last reviewed 12 September 2026.