Built for confidential sustainability work
Your data does not train anything
No model training
No inputs from your engagement are used to train a model from us or our providers
No selling, no sharing
We do not sell or share your data.
AI is labeled
Where required by law, including EU AI Act Article 50, outputs are identifiable as AI-generated.
Where your data lives
Stored in the United States
Your files, database records and generated outputs are stored in the US.
Separated by tenant
Customer data is logically separated between customers, with separate organization and personal workspaces.
Reachable only by the named team
Role-based access on the principle of least privilege. Only the people on your account can see your account.
Encrypted
TLS 1.2 or higher in transit. AES-256 at rest.
MFA and SSO
Multi-factor authentication is enforced for administrative access. Single sign-on is available for your team.
The controls in place
Monitoring and logging
Access to the service is logged, and alerting and log retention are being built out as part of our SOC 2 work.
Vulnerability management
Branch protection, approval-gated merges and automated checks on every code push. Dependency management is being formalized for SOC 2.
Backups
Automated backups and redundancy appropriate to the service.
People
Everyone with access to customer data is under written confidentiality obligations and is trained on their responsibilities.
Audit trail
Every source, calculation and revision inside an engagement is logged, built for limited-assurance scrutiny. That is the same trail your assurance provider is handed.
Documentation and certification
Data Processing Addendum
Available to every customer, with the subprocessor list, the security measures and the transfer mechanisms in it.
Audit rights
Under the DPA you can audit us, with 30 days' notice, once in any twelve-month period, through your own team or an independent auditor.
Privacy Policy and Cookie Policy
Published, and covering both the service and this website.
SOC 2
SOC 2 Type 1 is in progress. We will publish the report here when it is issued.
Security questionnaires
Send yours, we are happy to answer them.
Security contact
Let us scope your next report
