Security, data isolation and access control

Each incubator is a separate tenant, and every query the portal makes is scoped to that tenant. One incubator cannot read another's applications, startups, evaluations or funding records - not through the interface, and not by changing an identifier in a URL.

This is the property most often asked about and most often assumed rather than checked, so it is worth being precise: isolation is enforced on the server for every request, not by hiding controls in the interface. A request that arrives without a valid tenant context is refused rather than served with a default.

Access is defined per module and per role across five levels - create, read, update, delete and full - with per-user overrides on top. A finance lead can see funding without touching evaluation. An external panel member can score applications in one programme without reaching anything else in the portal.

That last case is the one that matters for evaluation integrity: bringing in an outside expert should not mean handing them the keys to the whole system, and it does not.

Applications move through six phases and every move records who made it and when. Requests for documents and requests for changes each carry their own state beside the phase, so a stalled application has a visible reason rather than a remembered one. Permission denials are logged alongside.

This is what makes the trail usable for grant and compliance reporting rather than merely present. A year after a cohort was selected, you can still reconstruct how - which is the question a funder actually asks.

Funding is followed from its source, to the programme it was allocated to, to the tranche that reached a specific startup. Over-allocation is blocked where the commitment is made, so a programme cannot promise the same money twice.

Payments run through Razorpay. Card and bank details are handled by the payment provider and never reach EcoSync. Uploaded documents go to encrypted object storage through signed URLs rather than passing through the application.

EcoSync does not hold SOC 2, ISO 27001 or any third-party security certification, and there is no published uptime SLA. We would rather tell you that here than have it surface halfway through a procurement review.

If your organisation has a specific requirement - a data-residency clause, a retention policy, an access-review cycle, a questionnaire to complete - send it to us and we will map it against what exists, item by item, and tell you where the answer is no.