Security statement

Workspace and organisation isolation

Each client works in its own workspace, and each workspace holds one or more organisations. Every request is checked on the server against the signed-in person’s workspace membership. A request naming an organisation outside that workspace is ignored, and the request is served only within the person’s own workspace.

Database reads and writes are filtered by workspace on the server, and by organisation where one is selected. The browser cannot widen a request to another client’s records.

Survey, interview review and invitation links, and the chat on the public home page, work without signing in. They are public by design: each link opens only what it was issued for, and the home page chat holds no client data.

Files and downloads

Uploaded files are stored under paths the server builds from the workspace and record. A file name supplied by the browser never chooses where a file is stored.

The server checks access before it returns a file, either directly or through a signed link that expires within one hour. A draft deliverable stays visible only to CoolPlanet reviewers until it is approved.

Encryption

All traffic to the platform uses HTTPS. The platform sends HTTP Strict Transport Security for one year, including subdomains, and tells browsers that other sites cannot frame its pages. The application reaches its database and each service provider below over encrypted connections.

Supabase, the database and file storage provider, encrypts stored data at rest.

Roles and permissions

Access follows each person’s role in the workspace. Full access members prepare data and generate reports. Approvers can also sign the GHG inventory, lock reporting periods and record the SBTi submission. Survey guests cannot open the workspace’s surveys or their results.

CoolPlanet administrators review every report before it is released. Licensed emission factor names and values are shown only to CoolPlanet reviewers.

Audit trail

Materiality, AASB S2 and SBTi decisions are written to an append-only audit log. Each entry carries a hash of the entry before it, so a changed or missing entry can be detected. The database refuses updates and deletions; entries are removed only when the whole workspace is deleted.

A signed GHG inventory keeps a frozen snapshot of the totals it certified.

Where data is held

The database and file storage run on Supabase in the AWS Asia Pacific (Sydney) region, Australia.

The application servers run on Hetzner in Nuremberg, Germany. Requests are processed there before data is stored in Sydney.

Service providers

The platform uses these providers for the purposes listed.

• Supabase: Database and file storage (Sydney).
• Hetzner: Application hosting (Nuremberg, Germany).
• Privy: Sign-in.
• Anthropic and OpenAI: Language models that read uploaded documents, classify transactions and answer questions in the assistant.
• Mistral: Reads text from scanned documents.
• Resend: Sends invitation, survey and notification email.
• Google Places: Address search while an organisation is set up.
• Australian Business Register: ABN lookup while an organisation is set up.
• MapTiler: Map imagery on the sign-in page. No client data is sent.