Security & Compliance
Last updated: October 2026. Implemented controls, their limits and evidence to request.
Our Commitment
CLIMATRIX includes access controls and review workflows for environmental and operational records. The controls described here have limits. Review the evidence, processing terms and recovery requirements for your organization before sharing sensitive records.
Platform Security
Password Storage
Account passwords are stored as bcrypt hashes. Passwords are not stored in a form that can be read back to you.
Sign-In & Password Reset
Sessions use expiring access tokens. A successful password reset makes the reset link single-use and prevents older sessions from authenticating subsequent requests.
Request Limits
Sign-in, registration, password-reset and import routes have configurable request limits. These controls reduce repeated requests; they do not guarantee protection from every form of abuse.
Infrastructure Evidence
All connections to the application and the API use HTTPS, with plain HTTP redirected and HSTS enabled. Details on hosting, storage encryption and processing locations are available on request.
Organization Access
Authenticated organization membership and roles govern access to workspace data. Authorization checks are tested across selected workflows; this is not a claim that cross-organization access is impossible.
Selected Audit Events
Audit records capture selected actions such as sign-in and ledger changes. Coverage varies by workflow and is not a complete record of every action or historical document.
Recovery Requirements
Backup frequency, retention and recovery times need operational verification. This page does not promise a recovery time, point-in-time recovery or automatic failover.
Security Review
Release checks include automated tests and dependency advisory reports. Unresolved build-tool advisories remain documented. These checks do not replace an independent security assessment.
Standards & Frameworks
Specific tools use the references below. Coverage varies by tool; using a framework does not certify the platform or your report.
GHG Protocol
Corporate Accounting & Reporting Standard for Scope 1, 2, and 3 emissions. The global benchmark for measuring and managing greenhouse gas emissions.
ISO 14064
International standard for quantification, monitoring, and reporting of GHG emissions and removals at the organizational and project level.
CSRD / ESRS
EU Corporate Sustainability Reporting Directive and European Sustainability Reporting Standards for mandatory ESG disclosures.
EU CBAM
Embedded-emissions calculations and draft declaration preparation. Importer-specific applicability and filing requirements need separate review.
TCFD
Task Force on Climate-related Financial Disclosures framework for climate risk reporting aligned with financial disclosures.
SBTi
Science Based Targets initiative references used in target planning. A plan created in the platform is not an SBTi-validated target.
PCAF
Partnership for Carbon Accounting Financials: data quality scoring methodology for financial institutions' financed emissions.
DEFRA
UK Department for Environment, Food & Rural Affairs emission factors database used for accurate GHG conversion calculations.
Compliance & Privacy
Confirm the requirements and supporting evidence for your organization. Software features alone do not establish legal compliance or certification.
Independent Assurance
This page does not certify GDPR compliance, SOC 2 readiness or independent assurance of the platform. Request the specific evidence your review requires.
Privacy Requests
Contact us about access, correction, export or deletion requests. Applicable requirements, identity checks and retention constraints need review for each request.
Processing Locations
Confirm storage regions, processing locations and relevant service providers before sharing data subject to location restrictions.
Processing Terms
Discuss required processing terms and agreements before onboarding sensitive records. This page does not represent a signed data processing agreement.
Technical Security Details
| Category | Implementation |
|---|---|
| Password Hashing | bcrypt with work factor 12 |
| Session Tokens | JWT (JSON Web Tokens) with configurable expiration |
| Transport Security | HTTPS only: plain HTTP is redirected, and HSTS is enabled on the application and the API |
| Data Encryption | Details on storage encryption and key management are available on request |
| API Rate Limiting | Configurable route limits; counter storage depends on deployment configuration |
| File Upload Limits | Limits vary by upload route; confirm the requirements for your import workflow |
| SSO | Google sign-in integration; provider configuration must be confirmed for the deployment |
| Database | PostgreSQL with parameterized queries (SQLAlchemy ORM) |
| CI/CD | GitHub Actions with automated linting, testing, and build verification |
| Error Monitoring | Details on error monitoring and incident response are available on request |
Security Inquiries
If you have security questions, need a detailed security questionnaire response, or want to report a vulnerability, contact us. Ask for the evidence relevant to your review.