Security

UnitTrack is built for sensitive utility data, so security is designed in and mapped to accepted standards. This page reflects current engineering practices.

Data protection at rest

Personally identifiable information is encrypted at the field level (AES-GCM), pseudonymized with keyed tokens, and stored separately from analytic data — aligned with NIST SP 800-53 (SC-28) and SP 800-122. The encryption key is held outside the database.

Access control

Role-based access with least privilege and separation of duties; a dedicated, gated PII Steward role is required to view PII, and each access is audited. Two-factor authentication is required for all users (NIST SP 800-63B). Access is application-mediated, not direct database access.

Disclosure control

Published aggregates pass statistical disclosure control — minimum-count (k-anonymity) and dominance rules plus complementary suppression — per the ESSnet/Eurostat SDC Handbook, so individuals can't be re-identified from released results.

Auditing & monitoring

Authentication and configuration events, and PII access, are recorded to an append-only audit log with actor, IP address, and user agent (NIST SP 800-53 AU-2 / AU-6). Application errors are monitored in production, with request bodies, cookies, and PII excluded from error reports.

Backups & recovery

The database is backed up on an automated schedule, plus independent encrypted off-site copies, and the restore procedure is tested — including verification that encrypted PII is recoverable.

Transport & application hardening

HTTPS/HSTS in production, a Content-Security-Policy and other response security headers, per-IP rate limiting on public endpoints, secure session cookies with timeouts, upload limits, and a managed database.

Payments

If and when billing is enabled, it is handled by Stripe via hosted checkout; card data never touches our servers, keeping us in PCI DSS SAQ-A scope.

Reporting a vulnerability

Please report security concerns to support@polishcloversolutions.com.

Polish Clover Solutions · Effective July 21, 2026.