Security
How ESGdesk™ protects your data and supports security, privacy, and compliance.
This document is provided in English as the official and legally binding version of the ESGdesk™ policies and agreements.
Security as a Design Principle
Security is a fundamental design principle of ESGdesk™. The platform is built to support secure, controlled, and predictable internal ESG data management for business users. ESGdesk™ is a B2B software tool, designed for internal use by companies. It is not a public data repository and not a consumer platform.
Our Security Philosophy
Least-Privilege Access
Users can only access what is necessary for their role
Workspace Isolation
Each company's data is logically separated
Predictable Workflows
No hidden automation or background data changes
Transparency Over Claims
No exaggerated or misleading security guarantees
Safeguards are designed to be proportionate to the nature of the data processed and to the intended internal use of the platform.
How Access Control Works
Access Control & User Management
Role-Based Access Control (RBAC)
ESGdesk™ uses predefined roles to ensure clear responsibilities and controlled access. Admin has full access to users, locations, Reporting Years, ESG data, and report generation. Contributor has limited access restricted to assigned locations and open Reporting Years. Roles are intentionally limited and standardized to reduce configuration errors and internal ambiguity.
Location-Level Permissions
In addition to role-based access, ESGdesk™ applies location-level restrictions. Users can access only locations explicitly assigned to them, view or edit data only within those locations, and never access data from other sites or organizational units. This is especially important for companies operating multiple plants, offices, or regions.
Auditor Access
Auditors receive time-limited, read-only access to review ESG data, reports, and analytics across all company locations. They cannot modify data, manage users, or access administrative functions. Access duration is defined at invitation and automatically expires.
Data Protection & Integrity
Reporting Year Protection
ESGdesk™ uses a Reporting Year concept as a core data-protection and governance mechanism. Open Reporting Years allow controlled data entry. Closed Reporting Years are read-only by design. Only Admins can deliberately reopen a closed year. This prevents unintended changes to finalized data and preserves historical consistency.
Data Isolation & Workspace Separation
Each ESGdesk™ workspace represents one company. Customer data is logically isolated per workspace, user accounts belong to a single company workspace, and reports are generated exclusively from data within that workspace. Logical separation is enforced at the application and data-access level within the platform.
Infrastructure & Hosting
Lovable Cloud (Europe)
ESGdesk™ is hosted entirely within Lovable Cloud (Europe). All components of the Service — including frontend, backend, databases, authentication, and file storage — are provided as part of the managed Lovable Cloud environment. Lovable Cloud applies its own physical, network, and operational security controls as part of its infrastructure services.
Encryption & Secure Communication
To protect data in transit, all connections use TLS/SSL encryption, HTTPS is enforced across the platform, and secure channels are used for authentication and data exchange. While no system can guarantee absolute security, industry-standard encryption is consistently applied.
Authentication & Account Security
Authentication relies on managed services provided within Lovable Cloud, including secure password handling and storage, protection against common brute-force and credential-stuffing attacks, and leaked password detection mechanisms where supported by the platform.
AI-Assisted Data Import Security
AI Processing Infrastructure
AI features are powered by Google's Gemini models, accessed via two channels: directly through the Google AI Studio API (for certain translation and processing tasks), and through the Lovable AI Gateway, a routing service operated by our platform provider Lovable AB. AI processing may involve the transfer of input data (documents, text, chat conversations) to servers located in the United States. Such transfers are made under Standard Contractual Clauses (SCC) and, where applicable, the EU-US Data Privacy Framework. By agreement with our AI providers, customer data is not used to train their models. A complete list of AI-related sub-processors is available at /legal/sub-processors.
Probabilistic Nature & Verification
AI extraction results are inherently probabilistic and presented as draft suggestions only. ESGdesk™ provides a mandatory verification interface where users must review, correct, and manually approve all AI-extracted data before it is saved. The platform does not automatically commit AI outputs to the database.
Document Handling
Documents uploaded for AI processing (utility invoices, fuel bills, waste reports) are processed transiently for the sole purpose of extracting ESG metrics. Incidental personal data in documents is not stored beyond the extraction process. Customers retain full control over which documents are submitted for AI analysis.
Subscription Tier Security Limits
ESGdesk™ enforces resource limits per subscription tier to maintain platform integrity and fair usage.
Free Trial
- 2 locations
- 2 users
- 3 AI imports (total)
- 14 days duration
STANDARD
- 5 locations
- 5 users
- 30 AI imports/month
- Full export access
PRO
- Unlimited locations
- Unlimited users
- Unlimited AI imports
- Fair Usage Policy
Limits are enforced both client-side and server-side to prevent unauthorized resource consumption.
Data Management & Continuity
Data Retention
ESG data (including AI-extracted content) is retained for five (5) reporting years. Free Trial data may be deleted 30 days after trial expiry if not converted to a paid plan. Billing data is retained per statutory requirements (min. 5 years).
Backups & Availability
Data backups and redundancy are handled by the managed cloud environment. Monitoring and maintenance are performed at infrastructure level. ESGdesk aims for high availability but does not guarantee uninterrupted service.
Third-Party Services Security
HubSpot CRM
ESGdesk™ uses HubSpot as a secure CRM platform for managing contact form submissions, meeting scheduling, and customer communications. Appropriate technical and organizational measures are in place to protect personal data processed via HubSpot, including access controls, data encryption, role-based permissions, and secure infrastructure. HubSpot maintains industry-standard security certifications and complies with GDPR requirements.
Payment Processing
Payment processing is handled by Stripe, a PCI-DSS compliant payment processor. ESGdesk™ does not store or process payment card details directly.
Email Services
Transactional emails are delivered through secure Google email services with appropriate encryption and authentication measures.
Shared Responsibility Model
Security in ESGdesk follows a shared responsibility approach between the platform and its customers.
ESGdesk
- Securing the application and hosting environment
- Enforcing role-based and location-based access controls
- Maintaining Reporting Year protections
- Applying retention and deletion rules
- Technical security of AI-Assisted Data Import infrastructure
Customers
- Assigning roles appropriately
- Managing users and permissions internally
- Ensuring data entered is lawful and appropriate
- Verifying and approving all AI-extracted data
- Following internal security and governance policies
ESGdesk does not replace internal IT security, compliance, or governance processes. AI-extracted data accuracy is the Customer's responsibility.
Audit Trail & Data Access Logging
Immutable Audit Trail
ESGdesk™ maintains an append-only audit trail that records all security-relevant actions across the platform, including data changes, user management events, and authentication activity. Audit log entries cannot be modified or deleted.
Data Access Logging
The platform logs access to sensitive areas such as dashboards, reports, user profiles, and administrative views. Data access logs record who accessed what data and when, supporting accountability and compliance reviews.
GDPR Art. 15 Data Export
Users can request a structured export of all personal and activity data held by the platform, provided under GDPR Article 15 (Right of Access). The export includes account data, activity logs, audit logs, and data access logs in a machine-readable JSON format.
Log Retention
Audit logs are retained for 24 months and data access logs for 18 months to support security monitoring, incident investigation, and regulatory compliance. Archived logs are preserved separately for extended retention where required.
What ESGdesk Does Not Claim
For clarity and transparency, ESGdesk does not claim to:
- •Provide absolute or guaranteed security
- •Eliminate all risks of data loss or misuse
- •Replace internal IT or cybersecurity controls
- •Certify compliance with specific security standards (such as ISO or SOC)
- •Prevent misuse resulting from customer-side actions
No cloud-based system is entirely risk-free.
In Summary
ESGdesk is designed to provide:
- Controlled access through roles and locations
- Protected Reporting Years
- Isolated company workspaces
- Hosting within Lovable Cloud (Europe)
- Encrypted data transmission
- Predictable data-retention and deletion rules
- Clear division of responsibilities
All to support secure, reliable, and calm internal ESG reporting workflows — so teams can focus on their work with confidence.
Incident Response & Security Assessments
Data Breach Notification
In the event of a personal data breach, ESGdesk™ will notify affected users and relevant supervisory authorities without undue delay, in accordance with GDPR Article 33. Security incidents can be reported to security@esgdesk.ai. We maintain internal incident response procedures and cooperate fully with supervisory authorities.
Security Assessments
ESGdesk™ undergoes regular internal security reviews including dependency audits, access control verification, and infrastructure monitoring. External penetration testing is planned for Q2 2026. The platform implements continuous automated vulnerability scanning and dependency updates.
Compliance & Legal Documents
ESGdesk™ operates in accordance with modern SaaS security, privacy, and data protection practices.
The following documents describe the legal and compliance framework governing the use of the ESGdesk™ platform.
Ready to get started?
Experience secure, structured ESG data management with ESGdesk