Security

Your emissions data is business data: bills, invoices, supplier records and the evidence behind every reported figure. Here is how Gaia keeps it secure, and how you stay in control of who sees what.

Hosting and operations

Gaia runs on Amazon Web Services (AWS) in the London region, across multiple availability zones that are physically separated from one another, so the failure of one does not take the platform down. Data is backed up at regular intervals around the clock, with backups held in access-controlled storage at separate AWS data centres. Your emissions data and documents are stored and processed in the UK. A small amount of contact data, such as names and email addresses, is handled by our email and support providers outside the UK. Our subprocessors page lists each provider and where it processes data.

Behind the product, security runs as a managed discipline. Gaia is Cyber Essentials Plus certified, the UK government-backed scheme whose Plus tier adds a hands-on technical audit of our controls. We take a risk-based approach, with a risk assessment and treatment plan reviewed at least annually and information security objectives set and reviewed each year. Everyone in the organisation goes through regular security training and awareness. Data and devices are encrypted wherever possible, application secrets are encrypted, access to code and infrastructure is role-based, every release passes QA before it ships, and incidents are reported, prioritised and tracked through to resolution.

In the platform itself, passwords are stored as one-way hashes, two-factor secrets are encrypted, sign-in attempts are rate-limited, and connections to the database are encrypted. If you think you have found a security vulnerability, please report it to info@gaiacompany.io.

Access control

The right people, and only the right people

Sign-in is built for organisations, not just individuals: bring your own identity provider, enforce a second factor, and scope each user to exactly the data they are responsible for.

Single sign-on

Sign in with Microsoft Entra ID or Google. SSO is self-serve to set up for your organisation, and you can enforce it so every user signs in through your identity provider rather than a password.

Multi-factor authentication

MFA with an authenticator app and backup codes, enforceable across your whole organisation so a second factor is a rule, not a suggestion.

Role-based access

Permissions follow roles, including a site-level data-owner role, and users can be scoped to specific sites and subsidiaries so each person sees only the parts of the organisation they are responsible for.

Data protection

Where your data lives and how it is handled

Sensitive documents stay in the UK, and the evidence behind your figures is kept, not discarded.

GDPR and encryption

Gaia is GDPR-compliant and hosted on AWS, with data and application secrets encrypted and backups stored in access-controlled storage. See how we handle personal data.

UK bill processing

When you upload an energy or fuel bill for extraction, the document is processed in the UK (London region), and nothing counts towards your footprint until a person confirms it.

Read-only AI assistant

The G.AI assistant runs on Amazon Bedrock in London. It can read your account to answer questions but can't change anything, and Bedrock doesn't use your questions or data to train models.

Evidence retained

Bills, invoices and certificates attached to your emissions are kept as audit evidence, so the document behind a figure is still there when an auditor asks for it.

Accountability

Every change on the record

Trust in a carbon platform is not only about keeping intruders out. It is about being able to show exactly how every figure came to be.

Field-level audit trail

Changes to your emissions data and the records behind it are recorded at field level: who changed what, when, and from what value to what value.

Partner access is logged

When an accountant or consultancy partner works in your account, we log when they start and stop and any changes they make to your data, and your admins can review this in the User Action Log.

The external audit pack

One workbook with every calculation, the factor behind it, its data-quality tier, the evidence attached, the assumptions register and the factor-year change history, ready to hand to an external auditor.

Questions about security?

Ask us about hosting, access control or audit before you commit. We would rather answer up front.