Encryption & Data Protection
How your data is protected in transit and at rest.
In transit
Any time your data moves between two places, it is scrambled on the way so that anyone intercepting it sees nothing useful. This applies to every connection we make, not just the one to your browser.
| What is connecting | How it is protected |
|---|---|
| Your browser to Carbon Passport | Always encrypted — this is the padlock you see in your browser (HTTPS/TLS). The file that keeps you signed in only ever travels over that encrypted connection, never in the open. |
| Carbon Passport to our emission factor provider | Encrypted (HTTPS). |
| Carbon Passport to cloud storage and document scanning | Encrypted (HTTPS), using the storage provider's own protection. |
| Carbon Passport to the AI service that helps sort spending | Encrypted (HTTPS). |
| Carbon Passport to your accounting software | Encrypted (HTTPS). |
| Carbon Passport to our database | Encrypted. This one is built into the software itself: if the encryption were switched off, the platform would refuse to start at all. |
At rest
| What is stored | How it is protected |
|---|---|
| Your password | We never store your actual password. We store a scrambled version that cannot be turned back into the original — not even by us. Every password is scrambled differently (bcrypt, with a unique salt). |
| Your two-step login backup codes | Stored scrambled, never as readable text. |
| Our database | Encrypted on the disk it sits on, so the raw files would be unreadable to anyone who somehow got hold of them. |
| Your uploaded documents | Kept in encrypted cloud storage, with encryption switched on across the whole storage area. |
| Our own keys and passwords | Kept in a dedicated secure vault. They are never written into our software code. |
Accounts and access
- Two-step login is required on every account. If you have not set it up yet, your first sign-in takes you straight to the setup page, and you cannot use anything else until it is done. After that, signing in needs your password *and* a code from your authenticator app — without the code you do not get in. You also get backup codes in case you lose your phone.
- Repeated wrong passwords get blocked. After several failed attempts from the same place, sign-in is temporarily locked, so nobody can sit there guessing passwords.
- You are signed out automatically after a while. The thing that keeps you signed in is stored somewhere code running inside a web page cannot reach it.
- Your company's data is kept separate from every other customer's. We run an automated test across every part of the system that deliberately tries to reach one company's records using another company's login. It has to fail every single time.
Production hardening
Some protections are built into the software rather than set up separately afterwards, so nobody can turn them off by mistake. On the live system, the platform refuses to start at all unless its security keys, database login and approved web addresses are properly set. It also forces your sign-in to stay on an encrypted connection, insists on an encrypted link to the database, and switches off detailed logging so your data never ends up written into our system logs.
The platform only answers requests that arrive through our own web addresses. Anything coming from anywhere else is turned away.
To see what happens when data is deleted, read Data Deletion.