Security & trust

1. Data sources & licensing

All datasets in eolas come from public NZ government and intergovernmental sources. We don't generate or transform the underlying values — we package the data into one consistent API.

• Most NZ government sources publish under CC-BY 4.0 — free for any use, including commercial, with attribution.
• OECD data has tighter redistribution terms; we expose it for read-only API access and direct OECD-attribution links in dataset metadata.
• Stats NZ Geospatial / LINZ via Koordinates also CC-BY 4.0; attribution string included in every response.

Every /v1/datasets/{name}/data, /v1/bulk/…, and changelog feed response carries X-Eolas-Attribution and X-Eolas-Licence headers (same wording as bulk NOTICE.txt). Snowflake share consumers query eolas.EOLAS_META.ATTRIBUTIONS.

Every dataset detail page links to the canonical source so you can verify lineage yourself. We have no exclusive rights to any of this data — you could always fetch it directly. eolas just saves you the scraping.

2. Hosting & geography

• Region: AWS Sydney (ap-southeast-2) — the closest commercial region to New Zealand.
• Data lake: Apache Iceberg tables on S3, catalogued in AWS Glue. Open format — no vendor lock-in.
• Serving: Two FastAPI services (eolas-web, vs-api) on AWS ECS Fargate behind an Application Load Balancer, fronted by Cloudflare (proxied — WAF + DDoS protection). Origin access is restricted to Cloudflare: Authenticated Origin Pulls (mutual TLS) and a security group locked to Cloudflare's IP ranges.
• Customer database: Amazon RDS PostgreSQL (Multi-AZ) in Sydney — accounts, API keys, billing metadata. Not co-located with the data lake.
• Enterprise share: Snowflake zero-copy data share over the same Iceberg files — you pay your own Snowflake compute, we don't sit in the data path.
• ETL: AWS Fargate, scheduled by EventBridge in NZ time. One container per pipeline, ephemeral and idempotent.

3. Uptime & observability

• Live status: eolas.fyi/status — checks DB, S3, Glue catalog, and dataset index every minute, no auth required.
• External monitoring: Better Stack pings /health/full every 3 minutes from outside AWS; email alerts on failure.
• Error tracking: Sentry on both web and API services. We see exceptions before customers do.
• Pipeline failures: EventBridge → Lambda → SMTP alert if any ETL container exits non-zero. The operator is paged automatically.
• SLA: Free / Pro plans are best-effort. Enterprise customers get a written SLA — typically 99.5% monthly uptime on the API surface, with refresh-cadence guarantees per dataset. Summary: docs.eolas.fyi/sla.

4. Application security

• Transport: HSTS enforced; HTTP 80 redirects to 443 unconditionally; Cloudflare-proxied with Authenticated Origin Pulls (mTLS) so the origin rejects any non-Cloudflare request.
• Security headers: Content-Security-Policy (incl. frame-ancestors), X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, HSTS — enforced on the public edge and version-controlled in the platform config.
• API authentication: X-API-Key verified by SHA-256 hash; the displayable copy is encrypted at rest (Fernet). Rotate any key from your dashboard.
• Account security: bcrypt passwords; HttpOnly + Secure + SameSite=Lax session cookies; CSRF tokens on every state-changing form; Cloudflare Turnstile on auth forms.
• Brute-force defence: per-IP rate limits (login 5/15min, signup 10/hr, reset 3/hr) plus per-account lockout after repeated failures — keyed on the account, so rotating IPs doesn't evade it.
• Two-factor auth: optional TOTP 2FA with one-time recovery codes, enforced at login for enrolled accounts (optional 30-day trusted device).
• Session hygiene: a password reset or change invalidates all existing sessions and the trusted-device cookie, and rotates the account API key.
• Monitoring: failed admin logins, account lockouts, and admin access-control denials are logged and alerted (Sentry + email).
• Stripe webhook: HMAC-SHA256 verified; replay protection via timestamp window and event-id deduplication. Restricted-scope key on the server — never a full-account sk_live_.
• Secrets & access: application secrets in AWS Systems Manager Parameter Store (SecureString), loaded at boot — never in git; AWS access via IAM task roles (no long-lived access keys); operator access via AWS SSM Session Manager (no public SSH on the control plane).
• Supply chain: Dependabot + pip-audit in CI; deploys ship only committed code (git archive / image builds from committed sources), never a working tree.

5. Privacy & PII

• No customer PII in the data layer. The datasets we serve are public-source statistical aggregates; no individual records.
• Account data: email, name, hashed password, plan tier, API key hashes, request logs (key hash + method + path + status + duration, no payloads). Stored in Amazon RDS PostgreSQL (Multi-AZ) in Sydney, with automated backups — separate from the public data lake.
• Analytics: Plausible (cookieless, GDPR-clean, no IP retention, no fingerprinting). No Google Analytics.
• Email: Resend (US-based), used only for transactional mail — verification, password reset, billing notifications.
• Stripe: Payment data never touches our servers. Stripe is PCI-DSS Level 1.
• Your rights: Under the NZ Privacy Act 2020 (and GDPR if applicable), you can request a copy of, or deletion of, your account data at any time. See privacy policy or email [email protected].

6. Incident response

If something breaks badly enough to affect customers — outage, data quality regression, security event — here's what happens:

1. Sentry / Better Stack / EventBridge alert fires within minutes.
2. Status page is updated to reflect the affected subsystem.
3. For security-relevant incidents: affected customers are emailed within 72 hours of confirmation (NZ Privacy Act default).
4. Post-incident review published as a Changelog entry within 7 days.

Report a vulnerability privately at [email protected]. We commit to acknowledging within one working day. A public /.well-known/security.txt also points here.

7. Independent assessment

In June 2026 the public web surface was assessed with a non-destructive OWASP Top 10 (2021)-aligned automated scan (BountyShield / owasp-url-scanner). Findings related to security headers and clickjacking defences were remediated; the live site now ships HSTS, CSP (including frame-ancestors), and related headers.

This was an automated assessment, not a full human penetration test or a SOC 2 / ISO 27001 audit. The report is available under NDA on request. A human penetration test of the web and API surface can be commissioned as part of enterprise onboarding.

8. Subprocessors

Third parties that process data on eolas's behalf. The datasets themselves are public; the only customer data involved is account/billing metadata.

• Amazon Web Services — hosting, storage, compute, backups — infrastructure + account database + daily backups — AWS Sydney (ap-southeast-2).
• Cloudflare — CDN, WAF, DNS, DDoS protection, Turnstile — request metadata in transit — global edge.
• Stripe — payment processing (PCI-DSS Level 1) — billing & payment data (never stored on our servers) — US / global.
• Resend — transactional email — name + email for verification, reset, and billing mail — US.
• Sentry — error monitoring — exception data + request context — US / EU.
• Better Stack — uptime monitoring + log management — health-check and log data — EU.
• Plausible Analytics — cookieless web analytics — aggregate page views, no PII, no IP retention — EU.
• Snowflake — enterprise data share (customer-initiated) — public dataset data only; you run your own compute in your chosen region.

We'll give notice of material subprocessor changes to Enterprise customers under contract. A Data Processing Addendum is available on request.