Privacy architecture

Audit & Origin — "shape, not secrets"

• Before anything is sent, your product name, supplier names, and part numbers are replaced with irreversible tokens (SUP-c109b709) — HMAC-SHA256 on your machine, in your browser or CLI. The token↔identifier mapping is encrypted (AES-256-GCM, key derived from your passphrase) and never leaves your network; you re-identify our recommendations locally.
• Our ingestion validator is the gate: payloads with raw identifiers or personal data are rejected, not quietly accepted.
• The free in-browser diagnostic makes zero network requests — verify it yourself in your browser's network inspector.

Scope 3 agent — nothing leaves at all

• The collection pipeline is pure Python standard library and runs entirely on your infrastructure — there is no Climacope server in the loop, so the strongest privacy statement is structural: we never see the data.
• The one optional outbound path — LLM extraction of messy documents — redacts by default: emails, phone numbers, and organizations you name are replaced with placeholders before the API call and restored locally in the output.
• The code is open (MIT) — the claims above are inspectable, and its test suite includes tests asserting identifiers never reach the API request body.

Compliance — the least identified data the job allows

• Your ledger never leaves your browser: spend files are categorized and aggregated locally; the platform receives category totals ("Metals: $1.6M"), not vendor names or line items.
• Redaction before AI: supplier names, emails, and phone numbers are replaced with placeholders before any prompt reaches our LLM provider — which we use on paid-tier terms, under which prompts and responses are not used to improve the provider's products.
• Supplier contacts are consent-gated: encrypted at rest (AES-256-GCM), masked in every interface and API, and decrypted only at the moment a buyer explicitly triggers a send. Every message carries one-click unsubscribe.
• Tenant isolation via database row-level security, enforced in CI.

Honesty notes (read these too)

• Redaction and PII scanning are pattern-based data-minimization measures, not guarantees — good data hygiene on your side still matters, and our validators err toward rejecting.
• We hold no SOC 2 or ISO 27001 certification today; this page describes actual controls, not certifications, and we won't upgrade the claim until certified.
• Details and legal terms: site privacy policy ·Compliance app privacy ·Data Processing Addendum.