Security and data handling matter here because a carbon inventory is built from invoices, meter readings and production records — commercially sensitive documents, not public information.
Security and data handling: what we do with your documents
A carbon inventory is assembled from things most companies would not publish: energy bills, production volumes, supplier invoices. That is the price of a traceable figure, and it puts an obligation on us that a spreadsheet template never carries.
Security and data handling: where it lives
Inside the European Union. Source documents, activity records and calculated results are stored on EU infrastructure, transmitted over TLS, and encrypted at rest.
Who can reach it
Access is role-based. Within your company you decide who can enter data, who can see the whole inventory, and who can export a report. Within Karbon360, access is limited to the people supporting your account — onboarding staff see what they need to structure your first inventory correctly and nothing beyond it.
Why source documents are retained
Because a figure without its document is an estimate. A review normally requires the invoice or meter reading behind each number, and a report where those have been discarded cannot be verified afterwards. Retention follows your reporting obligation, not ours.
Leaving
Your inventory is yours. Export includes the calculated results, the underlying activity records, the emission factor versions applied and the source documents — in a form another platform or an external verifier can actually read. A tool that makes leaving difficult is a tool that expects to disappoint you.
What we do not claim
Karbon360 is not currently certified to ISO 27001 or SOC 2. When that changes we will say so with the certificate and its date, rather than implying it with a badge. Roadmap is labelled as roadmap here for the same reason it is labelled that way everywhere else in the product.