Your sustainability data stay on your devices, not on our servers.

Project data, energy and activity figures, evidence such as invoices and payroll summaries, internal notes and generated reports are processed in the app's protected storage on your device. The app has no developer reporting backend, no developer analytics or tracking and no advertising identifiers.

Without the encrypted workspace, projects are protected by the app's sandbox and the operating system: on iPhone and iPad by the system encryption tied to the device passcode, on a Mac by FileVault when it is switched on. Integrity seals reveal changes made to the files outside the app, but they do not encrypt anything.

Calculations, report generation and the checks before export run on the device. If you choose an exchange folder in iCloud Drive, copies of documents are stored there without encryption by the app; the project itself stays in protected storage.

The encrypted workspace is switched on manually on each device, in Workspace & security under Advanced security and recovery settings. You choose a backup folder; the app makes and verifies a safety backup, generates the recovery key and builds an encrypted copy of the projects (AES-256-GCM). The original projects stay untouched, and the device key is kept in the Keychain.

Each approved device holds only its own wrapped copy of the workspace key. The 256-bit recovery key is shown once when it is created and is not stored in the project, in iCloud, in logs or in backups. Store it outside your Apple devices: if all approved devices and the recovery key are lost, nobody can recover the data, including us.

Synchronisation and pairing become available once the encrypted workspace is switched on. The app works on Mac, iPad and iPhone, with any number of your devices. A new device sends a signed request, an approved device checks its name and fingerprint, and you compare a short code on both screens. Only then does the new device receive a key envelope made for it alone; neither the raw key nor readable project data are transferred.

Synchronisation uses your private iCloud database, where Apple's servers see only encrypted chunks and pseudonymous technical metadata. Changes made offline are sent when the network returns, and conflicting versions are kept for you to decide; no version is discarded silently. Working on one device needs neither iCloud nor pairing.

A lost device can be revoked from a remaining approved device with the recovery key; the key is rotated, so later changes no longer reach it. Revocation cannot erase what the lost device already holds, which is why device passcodes and disk encryption matter.

• Reports, packages and questionnaires leave the device only when you save or share them, as a separate copy
• A package contains the report, structured data and only the documents you include; the rest of the project stays with you
• Backups of the encrypted workspace are encrypted files that contain only ciphertext and signed metadata; a restore is fully verified before it replaces anything
• Email evidence connects directly to your mail provider over verified TLS; passwords stay in the device Keychain and every outgoing message needs your confirmation
• Optional local AI sorting of documents runs only on your device, with no cloud fallback
• On a Mac, an AI agent you authorise works through the CLI under approval rules and never receives the workspace key

Stored projects carry an integrity seal; if it does not match, the app stops writing instead of continuing with altered data. When a report is ready for review, Audit Ready records a signed baseline and logs every later change, and the package returned by an independent reviewer is signed with a key kept in the Secure Enclave of the reviewer's device.

• Switch on the encrypted workspace on every device that holds client or employee data
• Use a device passcode, and FileVault on a Mac that holds evidence
• Keep the recovery key apart from your devices and backups, and never send it to anyone, including support
• Share packages through an encrypted channel agreed with the recipient
• Keep an independent backup; synchronisation does not replace it
• Revoke a lost device from a remaining approved device straight away