Security & trust

The free readiness tool runs entirely in your browser. Your client's intake answers, any report you upload, and the generated output are processed on your device and never leave it. The strongest data protection is data we never receive.

• Encryption in transit (TLS) and at rest.
• Access control, the database is locked down (row-level security) and reachable only by the server, never the browser.
• Evidence files live in a private bucket, shared only via short-lived signed links.
• Secrets (keys, tokens) are server-only and never shipped to the client.
• Input handling, user-supplied content is escaped/sanitised to prevent injection.

The third-party services we rely on, each bound to protect the data they handle:

• Vercel, Application hosting & delivery (USA)
• Supabase, Database & file storage for the Collect (Pro) tier (USA)
• Resend, Transactional email (Collect requests, reminders, alerts) (USA)
• Groq, AI inference for grounded narrative drafts & document extraction (Pro) (USA)
• Google (Gemini API), AI inference for document auto-fill (Pro) (USA)
• Mixpanel, Product analytics, only with your consent (USA)
• Google Analytics, Web analytics, only with your consent (USA)

The full data-handling detail is in our Privacy policy.

Every emission factor and disclosure mapping is cited to its primary source (SEBI, ICAI, CEA, IPCC/DEFRA), with the exact table, vintage and link. We never invent figures. See how we calculate.

We are honest about what is in progress: ISO 27001 certification (the standard Indian enterprise procurement asks for), an India data-residency option, and a published status page with uptime history. We would rather tell you these are coming than display a badge we haven't earned.

Found a security issue? Please email rahulu626@gmail.com with details. We appreciate responsible disclosure and will respond quickly. Please don't run denial-of-service tests or access data that isn't yours.