Where your data lives

Energy Agent runs on a single server in AWS’s US East (N. Virginia) region. The files you upload, the normalised data derived from them and the reports the analysis produces are stored on an encrypted volume attached to that server (Amazon Elastic Block Store, EBS, with encryption at rest turned on). Utility Bill Analyzer stores bill PDFs in a private Amazon S3 bucket and its extracted records in Amazon DynamoDB, both encrypted at rest.

None of our storage is reachable from the internet. Every bucket in the account blocks public access, and the two buckets that serve our websites can be read only by our own content delivery distributions.

Encryption in transit

Every site and application is served over HTTPS only, with a minimum of TLS 1.2 (Transport Layer Security, the protocol behind the padlock). Plain HTTP requests are redirected. Each host sends a Strict-Transport-Security (HSTS) header telling browsers to use HTTPS for a year, along with headers that prevent framing by other sites and content-type sniffing.

Backups and recovery

• A snapshot of the Energy Agent volume is taken every 12 hours; the most recent 14 are kept.
• A nightly encrypted archive of the database and every uploaded file is written to a private, versioned S3 bucket and kept for 45 days.
• Restores are rehearsed with a script that restores a real backup into a scratch environment and checks database integrity and file completeness. Most recent drill: 8 September 2026, passed.
• DynamoDB tables have point-in-time recovery, which allows restoration to any second in the last 35 days.

Who can see it

• Accounts are invite-only. There is no public sign-up; an administrator issues every invitation.
• Passwords are stored as Argon2 hashes, never in a readable form, and must be at least 12 characters. Sign-in sessions expire after 14 days. Failed sign-ins are throttled.
• Every request is checked by one authorisation layer that scopes data to your organisation. Data belonging to another organisation is not merely refused, it is reported as not found.
• Sharing across organisations is explicit and per building, with editor and read-only roles. Links that share a report expire after 90 days unless you choose a shorter period.
• Deletions, imports and share-link creation are written to an audit log with the acting user’s email.
• Administrative access to the servers is through AWS Systems Manager, which is itself logged. There is no SSH port open to the internet. The AWS account has one administrator, protected by a hardware security key, and no long-lived access keys. Account activity is recorded by AWS CloudTrail and monitored by Amazon GuardDuty.
• Energy Agent does not yet offer multi-factor authentication for user sign-in; it is on the roadmap. Utility Bill Analyzer supports authenticator-app (TOTP) multi-factor authentication today.

How the analysis is run

The engineering analysis is performed by Anthropic’s Claude models. By default they are served by Amazon Bedrock inside the Pelorus AWS account: AWS states that Bedrock does not store prompts or model outputs, does not share them with third-party model providers, and does not use them to train models. Energy Agent also offers, per analysis, the choice to run on Anthropic’s API directly, which is sometimes needed for the newest models. That choice is yours, it is shown on the run, and it is covered by Anthropic’s commercial terms, under which inputs and outputs are not used to train Anthropic’s models.

What the model sees: the facility profile you enter (address, floor area, building type, hours), any utility bill PDFs you upload (including the account numbers printed on them), and computed summaries of your interval and building-automation data. It does not receive the raw interval or trend files as a bulk export; it asks the analysis tools questions and receives tables of results.

What the model cannot do: the analysis agent runs under a default-deny tool policy. It cannot run shell commands, write files outside its own workspace, browse the web or search the server. Its file reads are confined to a single analysis’s directory, with symbolic-link escapes resolved and rejected, and this confinement is checked by an automated red-team test on every code change. Analysis code the model writes runs under an allow-list that blocks imports, file access and dynamic execution, with time and output limits. Reports the model produces are displayed under a sandboxed Content Security Policy so a maliciously crafted upload cannot act on your signed-in session.

AWS’s statement on Bedrock data handling: docs.aws.amazon.com, Amazon Bedrock data protection.

Other services that receive data

Four, and only four. We use no other subprocessor.

Deletion and retention

• You can delete an analysis or an entire building, with all of its uploaded files, from inside Energy Agent. Deletion removes the files from the server and revokes any share links.
• Deleted data can persist in encrypted backups until those backups age out, at most 45 days.
• We keep a building’s history for as long as your organisation is a customer, because verified savings depend on it.
• On written request we will delete your organisation’s data entirely, including backups as they expire, and confirm within 30 days.

Reporting a security concern

Write to info@pelorusengineering.com. We acknowledge reports within two business days and will tell you what we found and what we changed.

What we do not claim

• We do not hold a SOC 2 or ISO 27001 report. Everything on this page can be verified by reading the code or the account with us on a call.
• Hosting is in a single AWS region. A regional outage would take the products offline until it ends; it would not lose data beyond the last backup.
• This page describes the setup as of the date below and is updated whenever it changes.