Security
Formation Evaluation reads and writes a project folder on your own computer. Well logs, LAS or DLIS, are parsed in your browser and are never uploaded to our servers.
When you open a project, your browser asks for permission to a folder you choose. Curves, zones, parameters and interpretation cases are saved there, and a short-lived draft is kept in your browser's own storage so a crash does not lose work. None of it is stored in our database. Every log format, LAS, ASCII, LIS (binary LIS 79 included) and DLIS, is parsed in the browser; there is no upload step for well data anywhere in Formation Evaluation.
Your account, subscription status, and the cases you choose to save to the cloud from Volumetrics, Investment and Scenario Planning, together with team sharing and review notes. These are stored in a managed Postgres database with row-level security, so each record is readable only by its owner and anyone they have shared it with.
After one visit while signed in, Formation Evaluation and Well Correlation open without a connection. While online, our server issues a signed pass stating who you are and what your plan unlocks, good for up to 7 days or 100 hours of active offline use, whichever comes first; your browser checks the signature with a public key, so the pass cannot be forged or extended, and a lapsed subscription is caught within a week. Reconnecting renews it. Offline, the Formation Evaluation workspace, its interpretation and its exports run from your project folder; billing, cloud saves and sign-in wait for the network.
Card details are entered on Stripe's hosted checkout and never reach our servers. We store only the subscription reference Stripe gives us.
All traffic uses TLS. Our database provider encrypts stored data at rest. Sign-in sessions are held in secure cookies, and our API endpoints are rate-limited.
Supabase (authentication and database), Vercel (hosting), Stripe (payments), Resend (transactional email) and Upstash (rate limiting). The full list and what each one handles is in our privacy policy. Data may be processed in the United States.
Reservoir Risk Solutions does not yet hold SOC 2 or ISO 27001 certification itself. Our infrastructure providers are independently audited. For procurement reviews we answer security questionnaires, and we sign a data processing agreement (DPA) with Enterprise customers.