Trust
Where does your data live?
Tenant isolation, encryption in transit, multi-factor access for everyone, and backups that are restored, not assumed.
Your data stays yours
Carbon data describes your energy costs, production volumes and supplier relationships. It is stored per tenant and isolated, and the proofs published externally commit to hashes rather than to the data itself.
That means a customer can verify one of your figures without seeing the invoices, meter readings or supplier terms behind it.
Security is not a pricing tier
Multi-factor authentication is required on every account, on every plan. Controls that protect an account are not sold separately.
Controls
Universal MFA
Required for all accounts, with passkey and recovery-code support.
Tenant isolation
Organisation scoping enforced through every service layer.
Encryption in transit
TLS between internal services, not only at the edge.
Per-service signing keys
Each service holds its own key; no single shared secret grants fleet-wide trust.
Rate limiting
Applied at the gateway and separately at sensitive endpoints.
Verified backups
Daily database backups, checked by restoring them.
Tamper-evident audit log
Administrative actions written to the same hash-chained log; a line altered afterwards breaks the chain.
Self-checking services
Services validate their own configuration at startup and refuse to run misconfigured.
FAQ
Where does our production data live?
On infrastructure in the country the data is generated in, isolated per company. It is not pooled with other customers and it does not leave that boundary — only tamper-evident hashes do.
The free tools on this site are a separate matter: they run entirely in your browser and send nothing anywhere, because there is no server behind them to send it to.
Do you train models on our data?
No. And the calculation path contains no model at all: a carbon figure is arithmetic over declared inputs and versioned factors, which is what makes it reproducible.
Where AI is used — reading documents, spotting anomalies, answering questions about regulation — it works around the number, never inside it.
Which security features come with which plan?
All of them, on every plan. Multi-factor authentication, session hardening and rate limiting do not vary by what you pay; this is enforced in the code rather than promised in a table.
Plans differ in product capability — how much you can produce, whether records are anchored, API access. Never in whether your account is protected.
Make your carbon data impossible to doubt.
Join forward-looking companies turning emissions into verifiable, audit-ready proof.
Request a demo