Privacy Architecture

Product	Mechanism	The promise
Audit & Origin	Client-side tokenization	We only ever see the anonymized shape of your BOM
Scope 3 agent	Self-hosted, zero dependencies	Your supplier data never leaves your infrastructure
Compliance	Data minimization + encryption	We hold only what the task requires; identified data is named and contracted

Audit & Origin — "shape, not secrets"

Before anything is sent, your product name, supplier names, and part numbers are replaced with irreversible tokens (SUP-c109b709) — HMAC-SHA256 on your machine, in your browser or CLI. The token↔identifier mapping is encrypted (AES-256-GCM, key derived from your passphrase) and never leaves your network; you re-identify our recommendations locally.
Our ingestion validator is the gate: payloads with raw identifiers or personal data are rejected, not quietly accepted.
The free in-browser diagnostic makes zero network requests — verify it yourself in your browser's network inspector.

Try the ingestion gate

This is the Studio's intake gate, running in your browser. Type a supplier name such as Acme Plastics into a supplier cell, or an email or phone number into a notes cell, and it is rejected with the gate's own message. A token such as SUP-c109b709 passes. Nothing you type is sent anywhere. The only request this page makes after it loads is one cookieless pageview count carrying the page path, with no referrer, screen size, clicks or timings; the gate itself makes none. You can confirm both in your browser's network inspector.

The live demo needs JavaScript, and it runs only in your browser. The same rules run in the open-source validator (kit/climacope_validate.py).

Pattern-based checks, the same ones the Studio applies before any upload. Not legal, regulatory or investment advice.

Scope 3 agent — nothing leaves at all

The collection pipeline is pure Python standard library and runs entirely on your infrastructure — there is no Climacope server in the loop, so the strongest privacy statement is structural: we never see the data.
The one optional outbound path — LLM extraction of messy documents — redacts by default: emails, phone numbers, and organizations you name are replaced with placeholders before the API call and restored locally in the output.
The code is open (MIT) — the claims above are inspectable, and its test suite includes tests asserting identifiers never reach the API request body.

Compliance — the least identified data the job allows

Your ledger never leaves your browser: spend files are categorized and aggregated locally; the platform receives category totals ("Metals: $1.6M"), not vendor names or line items.
Redaction before AI: supplier names, emails, and phone numbers are replaced with placeholders before any prompt reaches our LLM provider — which we use on paid-tier terms, under which prompts and responses are not used to improve the provider's products.
Supplier contacts are consent-gated: encrypted at rest (AES-256-GCM), masked in every interface and API, and decrypted only at the moment a buyer explicitly triggers a send. Every message carries one-click unsubscribe.
Tenant isolation via database row-level security, enforced in CI.

Honesty notes (read these too)

Redaction and PII scanning are pattern-based data-minimization measures, not guarantees — good data hygiene on your side still matters, and our validators err toward rejecting.
We hold no SOC 2 or ISO 27001 certification today; this page describes actual controls, not certifications, and we won't upgrade the claim until certified.
Details and legal terms: site privacy policy ·Compliance app privacy ·Data Processing Addendum.

stream_label	supplier	part_number	notes