Data Protection

Encryption, key management, tenant isolation, backups, retention, and privacy practices

This page explains how PetroBench protects, stores, backs up and deletes customer data.

Key points

Encryption: TLS 1.2 or higher in transit, AES-256 at rest.
Isolation: Each organization's data is separated and access is checked on every request.
Location: Customer data is stored and processed in the United States.
Ownership: You own your data and can export it at any time.

Encryption

All customer data is encrypted both in transit and at rest:

Data	Method
In transit	TLS 1.2 or higher on all connections, with forward secrecy. TLS 1.0 and 1.1 are refused. HSTS enforced
Database	AES-256 encryption at the storage layer
Stored files	AES-256, in private cloud object storage with no public access
Backups	Encrypted before they leave production, and kept encrypted in transit and in storage
Sensitive fields and cookies	AES-256, authenticated with an HMAC
Passwords	Stored only as salted, adaptive one-way hashes. Plain-text passwords are never stored or logged
API access tokens	Signed
Webhooks and integration calls	Signed and verified with HMAC-SHA256
Password reset and invitation links	Signed, single-use and time-limited

Storage encryption keys: Managed by AWS for encryption at rest
TLS keys: Issued and stored by our CDN and hosting providers. No key material is held in our code, environment or hosts
Application secrets: Stored as encrypted environment variables, never in source code
Backup keys: The key that decrypts backups is held offline, separate from the backups

Customer data is logically isolated between organizations:

Every request is authorized on the server against the user's organization, role and assigned assets
Every database query is scoped to the authenticated user's organization
Within an organization, data is further scoped by the hierarchy of headquarters, divisions and regions
Files are authorized on every download. Users can never access another organization's files
API tokens and MCP connections act as the user who created them and follow the same boundaries
Automated authorization and organization isolation tests run on every change, and architecture tests fail the build if a tenancy boundary is bypassed

Aspect	Details
Continuous backups	The database backs up continuously with point-in-time restore
Nightly copies	Every night, an encrypted copy of the database and all stored files goes to a separate, isolated cloud account in a different US region, far enough away that a regional disaster cannot affect both
Immutability	Nightly copies use write-once storage. Nobody can change or delete them during their retention period
Restore testing	Restores are tested every month
Recovery point objective (RPO)	24 hours (maximum data loss in a disaster scenario)
Monitoring	Backup failures raise an alert

PetroBench does not use removable media for backups or customer data.

All customer data is stored and processed in the United States:

Component	Location
Application servers	AWS US East (Ohio)
Database	AWS US East (Ohio)
Stored files	United States
Backup copies	A separate US region
Edge network	Cloudflare global edge. Traffic may pass through servers outside the United States while in transit

No customer well data, simulation results, or account information is stored outside the United States.

Scenario	What happens
Active account	Data is retained for the duration of the service agreement
Contract end or termination	Customer data is deleted within 30 days
Written deletion request	Processed within 30 days
Backup copies	Expire on the fixed backup retention schedule above

Request a data export before your contract ends if you need a copy of your records. See the Privacy Policy for the full retention schedule.

Request a full export of your data at any time during your contract
Exports are provided in standard formats (CSV and JSON)
To start a full export, contact support@petrobench.com or your account representative

PetroBench collects data necessary to provide the service:

Well data: Information you enter about wells, equipment, and configurations
Simulation data: Inputs, parameters, and results from RodSim simulations
Uploaded files: Well and production data imports, fluid level shot reports, simulation reports, and screenshots attached to support requests
Usage data: Platform interaction data for improving the service (anonymized)

PetroBench holds a limited set of personal data, mostly business contact details:

Category	Examples
Account information	Name, email address, phone number, job title, company name
Credentials	Passwords, stored only as salted one-way hashes
Billing contacts	Billing contact name, email address and company billing address. Payment card data is handled only by our payment processor
Activity records	Audit log entries such as sign-ins and administrative actions, linked to the user

Personal data is not sent to AI systems by design. See AI and MCP Controls.

Your well data and simulation results are used solely to provide PetroBench services
We do not sell, share, or monetize customer data
Customer data is not used to train AI models

For privacy inquiries, contact legal@petrobench.com.