for your information

Security & trust

A plain-language summary of where the data lives, who can touch it, and what happens when things break. Aimed at procurement, but useful for anyone curious.

1. Data sources & licensing

All datasets in eolas come from public NZ government and intergovernmental sources. We don't generate or transform the underlying values — we package the data into one consistent API.

Most NZ government sources publish under CC-BY 4.0 — free for any use, including commercial, with attribution.
OECD data has tighter redistribution terms; we expose it for read-only API access and direct OECD-attribution links in dataset metadata.
Stats NZ Geospatial / LINZ via Koordinates also CC-BY 4.0; attribution string included in every response.

Every /v1/datasets/{name}/data, /v1/bulk/…, and changelog feed response carries X-Eolas-Attribution and X-Eolas-Licence headers (same wording as bulk NOTICE.txt). Snowflake share consumers query eolas.EOLAS_META.ATTRIBUTIONS.

Every dataset detail page links to the canonical source so you can verify lineage yourself. We have no exclusive rights to any of this data — you could always fetch it directly. eolas just saves you the scraping.

2. Hosting & geography

Region: AWS Sydney (ap-southeast-2) — the closest commercial region to New Zealand.
Data lake: Apache Iceberg tables on S3 (s3://vs-warehouse/), catalogued in AWS Glue. Open format — no vendor lock-in.
Serving: Two FastAPI services on an EC2 t3.medium behind nginx, fronted by Cloudflare (DNS-only, not proxied) with Let's Encrypt TLS.
Enterprise share: Snowflake zero-copy data share over the same Iceberg files — you pay your own Snowflake compute, we don't sit in the data path.
ETL: AWS Fargate, scheduled by EventBridge in NZ time. One container per pipeline, ephemeral and idempotent.

3. Uptime & observability

Live status: eolas.fyi/status — checks DB, S3, Glue catalog, and dataset index every minute, no auth required.
External monitoring: Better Stack pings /health/full every 3 minutes from outside AWS; email alerts on failure.
Error tracking: Sentry on both web and API services. We see exceptions before customers do.
Pipeline failures: EventBridge → Lambda → SMTP alert if any ETL container exits non-zero. Phil gets paged automatically.
SLA: Free / Pro plans are best-effort. Enterprise customers get a written SLA — typically 99.5% monthly uptime on the API surface, with refresh-cadence guarantees per dataset. Summary: docs.eolas.fyi/sla.

4. Application security

TLS everywhere: HSTS enforced; HTTP 80 redirects to 443 unconditionally.
Security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — all set at the nginx layer.
API authentication: X-API-Key header; keys are hashed at rest, you only see the plaintext once at issue time.
Web session security: Email + password with bcrypt; HttpOnly + SameSite=Lax session cookies; rate-limited login (5/15min), signup (10/hr), and password-reset (3/hr) to block credential stuffing and signup farming.
Stripe webhook: HMAC-SHA256 verified; replay protection via timestamp window and event-id deduplication. Restricted-scope key on the server (checkout + billing-portal write only; no full-account sk_live_).
Secrets: in systemd drop-ins on the EC2 box, not in git. Rotated by deleting + redeploying the unit file.
Server access: SSH key-only, password auth disabled. AWS IAM roles for in-VPC service calls — no long-lived AWS keys on the API box.

5. Privacy & PII

No customer PII in the data layer. The datasets we serve are public-source statistical aggregates; no individual records.
Account data: email, name, hashed password, plan tier, API key hashes, request logs (key hash + method + path + status + duration, no payloads). Stored in SQLite on the API box, backed up daily to S3 Glacier.
Analytics: Plausible (cookieless, GDPR-clean, no IP retention, no fingerprinting). No Google Analytics.
Email: Resend (US-based), used only for transactional mail — verification, password reset, billing notifications.
Stripe: Payment data never touches our servers. Stripe is PCI-DSS Level 1.
Your rights: Under the NZ Privacy Act 2020 (and GDPR if applicable), you can request a copy of, or deletion of, your account data at any time. See privacy policy or email [email protected].

6. Incident response

If something breaks badly enough to affect customers — outage, data quality regression, security event — here's what happens:

Sentry / Better Stack / EventBridge alert fires within minutes.
Status page is updated to reflect the affected subsystem.
For security-relevant incidents: affected customers are emailed within 72 hours of confirmation (NZ Privacy Act default).
Post-incident review published as a Changelog entry within 7 days.

Report a vulnerability privately at [email protected]. We commit to acknowledging within one working day.