Data Security

FloodSight is built for government disaster-management agencies, and we treat the security of your deployment accordingly. This page summarizes the platform's security posture.

Access control

Every deployment is provisioned per organization with role-based access control. Submitting simulations requires an analyst or administrator role, and every simulation, output file, and report is scoped to the account that created it. New accounts must verify their email address before they can use the API.

Authentication

FloodSight uses short-lived access tokens with rotating refresh tokens. Passwords are stored only as modern salted hashes, and password-reset and verification flows use single-use, expiring links.

Encryption and infrastructure

All traffic between your browser and FloodSight is encrypted with TLS. The platform runs on isolated environments (development, staging, production) with separate databases and object-storage buckets per environment. Simulation outputs are stored in Cloudflare R2 and are never exposed as public URLs — every download is authenticated and proxied by the application.

Data residency and isolation

Regional terrain and facility datasets are read-only inputs managed by SORA Technology. Your organization's simulation results live in your deployment's own storage, and deployments can be arranged to meet data-residency requirements.

Operations

Environments are deployed from a continuously tested codebase; every change passes automated linting, unit tests, and container-image vulnerability scanning before promotion from development through staging to production.

Reporting a concern

If you believe you have found a security issue in FloodSight, contact your SORA Technology point of contact or reach us through the request-a-demo form on this site, and we will respond promptly.