Greenly

Greenly hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Greenly publishes a DPA on its trust center; you can request access through SOC2C.

Greenly publishes an ISO certificate on its trust center; you can request access through SOC2C.

Greenly's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Greenly is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Greenly hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@greenly.earth or via a /security page.

Greenly lists 17 subprocessors on its trust center, including Google Cloud Platform (GCP), Auth0, Datadog, Wiz, Amazon Web Services. Buyers use this for fourth-party risk review.

Greenly hosts on AWS, GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Greenly publishes a DPA on its trust center. You can request access through SOC2C.

Greenly's trust center is at https://trust.greenly.earth. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Personal data is processed exclusively by Offspend, hosted by Amazon Web Service within the EU. We implement technical and organisational security measures to ensure the confidentiality, integrity and availability of your personal data. In addition, we are regularly audited by security specialists. To improve the security of our customers' data, Greenly has established a processing register listing all of our subcontractors. You can access our security policy by clicking on this link. Furthermore, Greenly has been SOC 2 Type 2 and ISO 27001 certified since 2023, demonstrating our commitment to data security and compliance with the highest industry standards. The trust of many customers, such as BNP Paribas, Arkea, Payfit, Ubisoft, RCI, etc., attests to our security policy, as these customers have audited our security systems. We have also been audited by the CNIL, who concluded that all our practices were compliant - something that is rarely noted. We're also happy to sign a confidentiality agreement (NDA) at your convenience.

The main function of the SAAS is to allow the realisation of the carbon footprint and the GHG report. This is done by carrying out various analyses. Data collection is made up of several main components : - The collection of the accounting entries file or accounting data for the extraction of expenses. - The collection of information via specific modules for physical analysis. - The collection of data from the company's employees for the calculation of commuting emissions. Greenly manually or automatically collects information on the client's company activity in order to produce a relevant carbon footprint measurement. Company data collected : - Expense data collected via accounting transactions - General company information (number of employees, revenue, region of activity, sector) - Data related to the company's buildings - Data related to the company's energy consumption - Data related to the consumption of equipment used indirectly by the company (data centers, networks etc.) - Any other data that allows us to characterise or refine the understanding of an internal process of the company (construction, manufacturing, marketing, distribution) - The quantity and quality of materials used in the construction of the company's products - The characteristics of the equipment used for the company's activity Information to characterise the company's internal logistic chains (in order to calculate the intermediate impacts) - Any other relevant information in pursuit of the objective of refining the accuracy of the carbon footprint calculation Action plans implemented in the company as part of the carbon footprint reduction project - The transportation data of the company's employees, as well as the meals habits of the employees.

The main function of the SAAS is to allow the realisation of the carbon footprint and the GHG report. This is done by conducting a questionnaire on employee habits. - Identification data: e-mail address, residence - Transportation data: transportation means the method of work related travel and distance To the extent such information directly or indirect allows one to identify a natural person (e.g., Customer employees): - Meal habits: number of vegan and meat meals per week - Work location habits: Remote, co-working, or working sites

- Log In / Log Off - Failed login attemps - Session Creation / Session Termination - Password Change - All Administrative actions and configuration changes performed - User Create / Read / Update / Delete actions, Document or Object Create / Read / Update - Delete actions - Metadata Create / Read / Update / Delete actions - Identifying users and the actions they performed - Integration logs: API call successes and failures - Infrastructure logs Hypervisor / OS - Database Log+Transaction Logs - Source IP address of the actor