Security for the emissions ledger
EMIZ treats carbon data the way finance treats the books: controlled access, clear residency, and a restore path when life happens. Built in Melbourne. Hosted for Australia.
Data stays in Australia
Customer ledgers are intended to live on Google Cloud in Sydney — not a US default region with an AU marketing line. We’re a Melbourne company building for Australian manufacturers who care where activity data and factor choices sit.
MFA on every login
After your password, EMIZ emails a 6-digit sign-in code. You can optionally enrol an authenticator app (TOTP) for a stronger second factor. Emissions numbers feed board packs and customer questionnaires; a password alone is not enough.
Backups like a closed period
Target ops: daily backups kept for 30 days, plus seven days of point-in-time restore. Access to backups is limited to a small authorised set. If something goes wrong, we restore the ledger — we don’t ask you to re-key a year of materials lines.
Recovery without theatre
App hosting is aimed at multi-AZ deployment (Vercel) with database recovery on GCP. We monitor for outages and keep a simple incident path: fix the system, tell affected customers what happened, and verify backups still restore. No “global SOC war room” branding — just a usable plan.
Who is certified — and who isn’t (yet)
Google Cloud’s Sydney regions carry host certifications such as SOC 2, SOC 3, and ISO 27001. That is the infrastructure layer. EMIZ as a company has not claimed its own SOC 2 or ISO certificate on this page — when we do, we’ll say so plainly. Until then we describe residency, MFA, and backup targets honestly, not as theatre.
Totals today, line items when you’re ready
Security questions often arrive with “can you take our full export?” Yes — CSV and Excel templates across sites and periods, with saved column mappings for the next close. Start with roll-up totals if that’s what you have; move to materials-level lines without changing product. Assisted PDF extraction and smarter mapping stay on the roadmap, always with a human confirm before anything posts to the ledger.