How we handle your data.
Plain answers about where your data is, who can see it and what we don't claim.
Where it's kept
Our primary database and file storage are in London (Supabase, eu-west-2, on Amazon Web Services). Our server functions run in London. A request first reaches our host's nearest network location, which may be outside the UK. Account emails are sent from the United States. The full list is in our Data processing terms.
Your evidence
Uploaded files are private to your organisation. There is no public link: a file is served only through a short-lived link to a signed-in member. Access is limited to your members and authorised seer. staff, and enforced in the database. We record each file's SHA-256 fingerprint.
A second person
On paid plans, a second person checks every entry. Nobody can check an entry they entered, edited, submitted or attached a file to. Checked entries can't be changed; a correction is a new version, and the old one is kept.
Method
Each plan states the standards it follows, your organisational boundary, the factor years used and the seven gases covered.
What's left out
Scope 1 and Scope 2 can't be left out. A required Scope 3 category with no entries needs your explanation, printed in the plan as “Not reported”.
Sub-processors
Supabase, Vercel, Google Cloud, Google Workspace, Resend and Sentry. What each does, where, and under which safeguard: Data processing terms, section 5.
AI bill reading
Off until an owner of your organisation has accepted our Data processing terms, or we hold a data processing agreement you signed. Bills are read in London only. The AI proposes values; a person confirms each one and, on paid plans, a second person checks the entry. We have completed a Data Protection Impact Assessment for bill reading, available on request.
Training
We don't use your data to train AI models, and Google doesn't use it to train its models. Google may keep a request in memory for up to 24 hours, and a flagged request for up to 90 days.
Deleting your data
How long we keep data and how deletion works: Privacy policy.
The factor files we loaded
Your ledger and plan use the UK government GHG conversion factors, published by DESNZ, exactly as published. For each year we loaded the flat file, cross-checked it against the full set, and produced a CSV. Here is the SHA-256 fingerprint of each.
2024
Greenhouse gas reporting: conversion factors 2024 (v1.1). Publication page on gov.uk
2025
Greenhouse gas reporting: conversion factors 2025. Publication page on gov.uk
2026
Greenhouse gas reporting: conversion factors 2026 (flat file revised July 2026). Publication page on gov.uk
Check it yourself. Download a file and run this. The result should match the fingerprint shown.
shasum -a 256 <file>
Spend-based factors
We have also loaded Defra’s spend-based conversion factors (2023 prices, all greenhouse gases, in kgCO2e per pound) and the ONS Consumer Prices Index, to estimate purchased goods and services from what was spent. A figure estimated from spend is labelled as an estimate and never added to a measured figure. A plan that follows the 2027 NHS requirements includes it in Scope 3 and total emissions, on its own labelled line. Publication page on gov.uk
- Defra’s file (download)
- f694d0e5bf7161bb01cb35eb7418dbf21af37fabc7df66ce4696b1dde364b389
- Our CSV of its 112 factors
- 7da560c3cfc5fb634188ee7f33f9ff3ba3bc73bffc5d8acb4e42fad83f40000e
- ONS Consumer Prices Index, series D7BT: our copy of 16 September 2026 (ONS page). The ONS updates this file every month, so a new download will not match.
- 27a2473f818423a499fce4be23a2816d6670b1ae93b8eaaa11687c2237322865
Contains public sector information licensed under the Open Government Licence v3.0.
The quick estimate on our home page uses different, spend-based figures and is not part of your ledger or plan.
Questions
Tell us your next deadline.
A tender, a buyer's questionnaire, CBAM or your annual report: we'll reply within one working day with what you need and what it costs.