Bank-Grade Security for Your Emission Data

Data Residency & Infrastructure

Primary database records and file storage are hosted in Mumbai, India (Supabase on AWS ap-south-1). Application hosting and compute are in Mumbai (bom1) via Vercel. However, automated document processing uses Google Gemini, which may process data outside India (including the United States).

Encryption & Isolation

• Row Level Security (RLS): Your data is cryptographically isolated from every other company on the platform at the database level.
• AES-256 Encryption: All data is encrypted at rest using industry-standard AES-256 encryption.
• SSL/TLS Encryption: All data in transit is secured via HTTPS/TLS 1.2+.
• Third-Party Processors: We never sell your data. To deliver our services, customer data and uploaded documents are processed by the following sub-processors: Supabase (database and file storage in Mumbai), Vercel (application hosting and compute in Mumbai (bom1)), Google Gemini (document OCR and usage extraction; may process outside India), and Resend (transactional email dispatches).

Access Control

CarbonTrack utilizes strict Role-Based Access Control (RBAC) to ensure only authorized personnel can view or modify data.

• • Owner: Full access to billing, settings, and team management.
• • Member: Access to upload data and generate reports.
• • Auditor: Read-only access that automatically expires after 30 days.

Audit Logging

Every significant action—from data uploads to report generation—is permanently logged in an immutable audit trail. This ensures full traceability and accountability during external BRSR or GHG verification audits.

Data Retention & Deletion

Operational emission data and audit trails are retained indefinitely while your account is active to support regulatory verification. Account and data deletion is currently handled manually on request via support email at support@carbontrack.ink.