Security

Access to your data

For each deployment, we agree with the customer which information is public and which is restricted to authorised users. We apply industry-standard access controls to restrict customer data to the personnel who need it to deliver the service: individual named accounts, permissions based on role, and multi-factor authentication for production systems.

Ledger records

Water Ledger records transactions on the Hedera distributed ledger. Personal data is hashed before it is recorded, so it does not appear on the ledger in identifiable form. The information needed to link a record back to an individual is held off-chain and encrypted at rest.

Hosting and encryption

We use Amazon Web Services (AWS) for production hosting. Personal data stored off-chain is encrypted at rest using AES-256, and data in transit is encrypted using TLS 1.2 or higher. Encryption keys are managed through AWS Key Management Service.

Our Privacy page explains how we handle personal information. For hosting or data protection requirements specific to your deployment, please contact us.

Software security

Every change to production code is tracked in version control, requires peer review by a second engineer, and is tested in a staging environment before release. Direct changes to the production branch are not permitted, and significant changes require additional approval. Automated scanning identifies known vulnerabilities in code and dependencies. Emergency changes follow a separate documented procedure and are reviewed after implementation.

Responding to incidents

Our incident response process defines how security incidents are reported, classified by severity, contained, investigated, resolved and reviewed. Where an incident affects customer data, we notify the customer without undue delay. Where a personal data breach is notifiable, we notify the Irish Data Protection Commission within 72 hours of becoming aware of it.

SOC 2

Water Ledger Global Limited was issued a SOC 2 Type 1 attestation report by AssuranceLab CPAs LLC, as of 31 May 2025. The report covers the Water Ledger Software as a Service System against the Security, Availability, Processing Integrity, Confidentiality and Privacy criteria. To request access to the report, please contact us.

Report a security concern

To report a suspected security vulnerability or incident, use our Security enquiries page or email security@waterledger.com. Both are monitored and treated equally. Please describe the affected service and what you observed, and do not include passwords, access keys or customer data in your initial message. We will not pursue legal action against researchers who report vulnerabilities in good faith.