Security you can
take to the wellsite.
Drilling data is commercially sensitive and operationally critical. Greenstone is built with security as a first principle, not an afterthought, so operators can trust us with their most valuable subsurface data.
Security Controls
A layered defence across infrastructure, data, identity, and operations.
Data Encryption
- Encrypted connections (HTTPS) for every website, API and platform request
- WITSML server credentials stored encrypted, never shown back in the interface
- Platform data hosted with Amazon Web Services, protected by its encryption and access controls
- Secrets kept in environment configuration, never in source code
Access Control
- Every request runs with the signed-in user's own permissions, including requests made by GeoEngine
- Access controlled at the account and project level
- GeoEngine never changes data on its own: every action is confirmed by the user
- Internal database identifiers are stripped from AI replies
Network Security
- Greenstone and GeoMaster websites served through Cloudflare, with its DDoS protection and web application firewall
- Platform services exposed only over HTTPS
- GeoEngine documentation lookups limited to docs.geomaster.uk
- Well coordinates stay inside GeoEngine and are never sent to web searches
Data Residency & Privacy
- UK GDPR: data processing agreements available on request
- No training of AI models on operator data: Claude models run through AWS Bedrock, which does not train on customer data
- Operator data deleted on request at the end of a contract
- Sub-processors listed on request
Operational Security
- Source code in private repositories with reviewed changes
- Access to production limited to the people who run it
- AI usage recorded per request for cost control and audit
- Security reports acknowledged within 48 hours (see responsible disclosure below)
Availability & Resilience
- Websites served from Cloudflare's global network
- Platform hosted on Amazon Web Services
- AI and calculation services run separately from the main platform, so the platform keeps working if GeoEngine is busy
- Service levels agreed per customer contract
Compliance Status
Our current posture and roadmap: updated Q2 2026.
Data processing agreements available on request
Formal certification planned
Planned as customer contracts require it
UK government scheme, planned for the platform
Found a vulnerability?
We take security reports seriously. If you discover a vulnerability in any Greenstone product or infrastructure, please report it directly to our security team. We commit to acknowledging reports within 48 hours and providing a fix timeline within 5 business days for critical issues.
security@greenstone.energyWe do not pursue legal action against good-faith security researchers.