How we handle your data

Carbon Compass publishes aggregated emissions data drawn from public corporate disclosures. We do not require visitors to create an account to browse the leaderboard or firm profiles. Accounts are only used internally by Carbon Compass administrators to maintain the dataset.

Administrator sign-in uses email/password authentication provided by our backend. Administrative actions (editing firm records) are restricted to accounts that have been granted an admin role server-side. Role checks are enforced in the database via row-level security and a security-definer helper, not just in the browser UI.

Application data is stored in a managed Postgres database. Row-level security is enabled on all application tables. Public emissions data is readable by anyone; write access is restricted to admin role holders. The privileged service key is never shipped to the browser and is only used by trusted server code.

All traffic to Carbon Compass is served over HTTPS. API calls from the browser to our backend use the same encrypted transport.

Carbon Compass is built on the Lovable platform and uses its managed hosting, database, and authentication services. We rely on these providers for infrastructure-level security, patching, and availability.

We run automated self-checks against our database daily (RLS coverage, admin availability, exposure of privileged helpers). Results are reviewed by Carbon Compass administrators. Automated scanning is a best-effort control and does not replace independent penetration testing.

If you believe you have found a security issue in Carbon Compass, please report it through our contact form (choose “Security issue”) . Please give us a reasonable opportunity to investigate before public disclosure.

Carbon Compass is responsible for the application logic, access controls, and database configuration described above. Our hosting provider is responsible for the underlying infrastructure. Visitors and administrators are responsible for keeping their own devices and credentials secure.