Security & compliance at Energy Market Price
We are committed to protecting our customers' data with industry-leading security practices. This page details our certifications, the 62+ controls we operate, our subprocessors and how we handle privacy.
Certifications & Compliance
The frameworks our security program is built and audited against.
SOC 2 Type II
Independent audit of our security controls' effectiveness over time, against the AICPA Trust Services Criteria. Our report was issued with an unqualified opinion.
Attested
ISO/IEC 27001
International standard for information security management systems, covering the 93 Annex A controls.
Certified
GDPR
Full compliance with the EU General Data Protection Regulation for the processing of personal data.
CompliantDocuments & Resources
Compliance documents are available to customers and prospects under NDA. Request access and our team will get back to you.
Security Controls
62 controlsThe technical and organizational measures we operate, mapped to SOC 2 and ISO 27001.
Organizational Security
- Information security policies reviewed and approved annually
- Designated security and compliance function with management oversight
- Annual company-wide risk assessments
- Security awareness training for all employees
- Background verification checks on new hires
- Confidentiality and non-disclosure agreements signed
- Formal employee onboarding and offboarding procedures
- Disciplinary process for security policy violations
- Internal audits and periodic management reviews
Access Control & Authentication
- Role-based access control (RBAC)
- Principle of least privilege enforced
- Multi-factor authentication (MFA) on all critical systems
- Unique named accounts — no shared credentials
- Quarterly user access reviews
- Immediate access revocation on offboarding
- Strong password and credential policy
- Single Sign-On (SSO) for internal applications
- Privileged access restricted, monitored and logged
Data Security & Encryption
- Encryption at rest (AES-256)
- Encryption in transit (TLS 1.2+ / TLS 1.3)
- Data classification and handling policy
- Secure cryptographic key management
- Data retention and secure disposal policy
- Logical segregation of customer data
- Encrypted backups, restoration tested regularly
Infrastructure & Cloud Security
- Hosted on Microsoft Azure (ISO 27001 & SOC 2 certified datacenters)
- Network segmentation, firewalls and security groups
- Infrastructure provisioned as code (IaC)
- Hardened baseline server configurations
- DDoS protection at the edge
- Production environment logically segregated
- High-availability and redundant architecture
Application & Product Security
- Secure software development lifecycle (SDLC)
- Mandatory peer code review before deployment
- Automated dependency and vulnerability scanning
- Static application security testing (SAST)
- Separate development, staging and production environments
- Formal change management process
- Annual third-party penetration testing
Endpoint Security
- Full-disk encryption on all workstations
- Endpoint detection & response (EDR) / anti-malware
- Automatic OS and security patch management
- Centralized device management (MDM)
- Automatic screen lock policy
Monitoring & Incident Response
- 24/7 security monitoring
- Centralized logging and audit trails
- Documented incident response plan
- Vulnerability management program
- Anomaly alerting with on-call escalation
- Audit logs retained for review
Business Continuity & Availability
- Automated and encrypted backups
- Disaster recovery plan tested periodically
- Defined RTO and RPO objectives
- Redundant, fault-tolerant infrastructure
- Public status page with uptime history
Privacy & GDPR
- GDPR-compliant data processing
- Data Processing Agreement (DPA) available
- Data Protection Officer (DPO) appointed
- Documented data subject request process
- Records of Processing Activities (ROPA) maintained
- Privacy by design and by default
- Vendor and subprocessor due diligence
Subprocessors
Third-party service providers we use to process data on our behalf.
| Provider | Purpose | Location |
|---|---|---|
| Microsoft Azure | Main infrastructure hosting | Worldwide |
| Microsoft 365 | Productivity and collaboration tools (email, document storage, communication) | Worldwide |
| Google Workspace | Cloud computing, productivity and collaboration tools (Gmail, Docs, Drive, Calendar) | Worldwide |
| Atlassian | Software development and collaboration tools | Worldwide |
| Leexi | Secure AI notetaker | EU |
| Zoho | Invoicing software | EU |
Data Privacy
How we protect personal data in line with the GDPR.
Our commitments
- Personal data processed lawfully, fairly and transparently
- Data minimization — we collect only what we need
- Data Processing Agreement (DPA) available on request
- Standard Contractual Clauses for international transfers
- Privacy by design and by default
- Records of Processing Activities (ROPA) maintained
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing.
To exercise any of these rights, contact our Data Protection Officer:
[email protected]Security Contact
For security inquiries or to report a vulnerability.