Policies
Compliance
Certifications, frameworks, and regulatory compliance
PetroBench maintains security and compliance practices designed for enterprise oil and gas operators. This page provides transparency into our certifications and the frameworks that govern our security program.
Framework Alignment
PetroBench's security program is aligned with industry-standard frameworks:
| Framework | Alignment |
|---|---|
| NIST Cybersecurity Framework (CSF) | Controls mapped to NIST CSF categories |
| OWASP Top 10 | Web application security testing covers all OWASP Top 10 categories |
Security Assessments
| Assessment | Frequency |
|---|---|
| Vulnerability Scanning | Continuous automated scanning of infrastructure and dependencies |
| Static Analysis (SAST) | Every code change, integrated into CI/CD pipeline |
| Dependency Auditing | Continuous automated alerts for known vulnerabilities |
| Secret Scanning | Every commit, before it can merge |
| Peer Review | Every change, with code-owner approval required on protected branches |
Automated Testing
No change reaches production without passing the full suite. Every pull request runs:
| Suite | What it verifies |
|---|---|
| Backend tests | Application behavior, authorization across every user role, and organization isolation |
| Frontend tests | Interface components, hooks, and validation schemas |
| Browser regression | End-to-end journeys in a real browser, including simulation workflows |
| Architecture tests | Guard rules that fail the build when a shared core or tenancy boundary is bypassed |
| Static analysis | Type checking, static analysis, and custom architecture and tenancy checks |
| Security scans | Static application security testing, secret scanning, and dependency auditing |
Data Handling
| Practice | Details |
|---|---|
| Data Residency | United States only (AWS US East, Ohio) |
| Data Ownership | Customers retain full ownership of their data |
| Data Portability | Export available in CSV and JSON formats |
| Data Deletion | Within 30 days of request or account termination |
| Data Classification | Well data and simulation results classified as confidential; usage analytics anonymized |
Request Documentation
To request compliance documentation, audit reports, or a Data Processing Agreement:
- Email: legal@petrobench.com
- Contact your Account Executive