Data Security

This Security Policy (“Policy”) describes the security measures and data protection practices for the Forestry Analytics for Carbon Tracking (“FACT”) platform, owned and operated by the U.S. Endowment for Forestry and Communities, Inc., a Delaware nonprofit corporation (the “Endowment”).

This Policy outlines key security considerations for FACT. Specifically, it focuses on data security relevant to FACT’s business requirements and on the broader context of data and software security baselines.

FACT is intended solely for Users located within the United States of America and Canada. Security measures described in this Policy are designed to comply with applicable U.S. federal and state requirements and applicable Canadian privacy and data protection legislation.

BETA PLATFORM NOTICE. FACT is an evolving platform that may contain errors, omissions, incomplete functionality, or data limitations. Features, datasets, methodologies, and outputs may be modified, updated, suspended, or removed without notice. Users acknowledge that service interruptions, technical issues, delayed updates, or temporary unavailability may occur and agree that such conditions are inherent to a beta-stage platform.

FACT is designed to limit the collection and retention of User-provided information where practical. Where FACT functionality permits, Users may upload information without creating an account or may choose not to save uploaded information permanently.

When a User chooses not to save uploaded information, the information is stored temporarily as needed to complete the requested validation, calculations, visualizations, reports, or exports. Access to calculations and results may be provided through a randomly generated task identifier rather than through an association with a specific User. The underlying information is deleted as described in this Policy after the User retrieves the calculation results.

Users should avoid submitting personal, confidential, or other sensitive information unless it is appropriate and necessary for their use of FACT.

Ensure minimization of exposure and secure processing of all personal and confidential information through a number of procedures.

• Personal Data is any information related to an identified or identifiable person.
• Confidential Information includes trade secrets, customer information, employee data, strategic plans, and any data with potential risk if disclosed.
• These categories are protected under an Information Classification Policy, with three tiers: Confidential, Internal Use, and Public. The strictest applies in case of mixed content.

• Data used in non-production environments is anonymized or randomly generated, encrypted at rest and in transit, and subject to strict access restrictions.
• Test data is securely deleted when no longer needed, in accordance with the Endowment’s Secure Development Policy.

• All employees and contractors are bound by confidentiality obligations, which extend beyond termination of employment. Data may not be disclosed, reused, or processed outside the strict scope defined by this Policy.

Procedures will be maintained for responding to suspected security incidents affecting FACT data or systems. If a security incident involving personal information requires notification, notice will be provided in accordance with applicable legal, contractual, and regulatory requirements. The timing, content, and recipients of any notification will depend on the nature of the incident and the requirements that apply.

• Google Drive is our exclusive storage platform for critical documentation, with AES-256 encryption at rest and TLS encryption in transit.
• External media storage is prohibited unless encrypted and explicitly authorized.
• Sensitive documents must be password-protected and shared over separate secure channels (e.g., password by SMS).
• Files are not stored locally or on unauthorized platforms, and corporate information is forbidden on personal cloud/email systems.

• Only services like Google Workspace, AWS, Google Cloud, GitHub, and Jira are authorized for storing/sharing data. Each is assessed against encryption, MFA, access controls, and compliance requirements.

• Backend input validation
• Centralized authentication and session management
• Access-controlled source code repositories
• Secure CI/CD pipelines with vulnerability scanning (e.g., Dependabot)
• Strict separation of dev/test/prod environments with no use of real production data

FACT will maintain procedures intended to support the recovery of FACT operations following significant service disruptions, infrastructure failures, or other business continuity events. These procedures may include backups and restoration activities appropriate to FACT’s operational requirements.

The FACT platform is developed and operated using security and quality management practices informed by recognized industry standards. Where applicable, the Endowment and its service providers may maintain certifications, audits, policies, or procedures aligned with standards including:

• ISO/IEC 27001:2022, Information Security Management Systems
• UNI EN ISO 9001:2015, Quality Management Systems

References to these standards do not represent a claim that the FACT platform itself, the Endowment, or every service provider is currently certified under those standards unless expressly stated and supported by the applicable certification.

The Endowment reserves the right, at its sole discretion, to suspend, restrict, or terminate any User’s access to FACT at any time, without notice and without liability, for any reason, including suspected violations of these policies, security concerns, or operational requirements.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE ENDOWMENT, ITS OFFICERS, DIRECTORS, EMPLOYEES, AGENTS, CONTRACTORS, SERVICE PROVIDERS, AND CONTRIBUTORS SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, EXEMPLARY, OR PUNITIVE DAMAGES ARISING FROM OR RELATING TO ANY SECURITY BREACH, DATA LOSS, UNAUTHORIZED ACCESS, SYSTEM FAILURE, OR OTHER SECURITY INCIDENT AFFECTING FACT OR USER DATA, REGARDLESS OF THE CAUSE.

THE FACT PLATFORM AND ALL DATA, CONTENT, AND SECURITY MEASURES ARE PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED. THE ENDOWMENT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, REGARDING THE SECURITY, INTEGRITY, OR AVAILABILITY OF FACT OR ANY DATA STORED OR PROCESSED THROUGH FACT. USERS ACKNOWLEDGE THAT NO SYSTEM CAN BE GUARANTEED COMPLETELY SECURE AND THAT THEY ACCESS AND USE FACT AT THEIR OWN RISK.

IN NO EVENT SHALL THE ENDOWMENT HAVE ANY OBLIGATION TO INDEMNIFY ANY USER OR THIRD PARTY FOR ANY CLAIM ARISING FROM OR RELATED TO A SECURITY INCIDENT, DATA BREACH, OR OTHER EVENT DESCRIBED IN THIS SECURITY POLICY.

IN NO EVENT SHALL THE TOTAL LIABILITY OF THE ENDOWMENT ARISING FROM OR RELATED TO THIS SECURITY POLICY EXCEED ONE HUNDRED DOLLARS ($100.00).

This Policy should be read together with the FACT Terms of Use, Privacy Policy, and Cookie Policy.