Security & Data Protection

METIMO handles employee commute data, which is personal data under UK GDPR. Security and data protection are built into how the Service is designed and operated, not bolted on afterwards. This page summarises the technical and organisational controls we apply. It is written for prospective customers, security reviewers, and procurement teams; company customers can also request our Data Processing Agreement and a more detailed accountability record.

Data protection by design

• Data minimisation: we capture only what a commute-emissions calculation needs — home-to-work distance (or a postcode-derived distance), transport mode, and working pattern. The Service does not track live location or continuous journey history.
• Purpose limitation: commute data is used to calculate Scope 3 Category 7 emissions and, for company customers, to produce aggregate employer reporting. It is not sold or used for advertising.
• Employer aggregation with a suppression threshold: employer reporting is aggregated and small groups are suppressed, so an employer cannot single out an individual employee from the figures it receives.
• Individual control: employees can export or delete their own data at any time from their account, independently of their employer.

Encryption

• All data in transit is encrypted over TLS between the browser, the application, and our infrastructure providers.
• Data at rest is encrypted at the hosting and database layer by our infrastructure providers.
• We never store card details — payments are handled entirely by Stripe, so card data never reaches our systems.

Access control and accountability

• Authentication uses a dedicated identity and session layer with server-side session management; secrets are held in environment configuration, never in application code.
• Access to production personal data is limited to authorised personnel on a need-to-know basis, and each company's data is logically separated so reporting is scoped to the relevant employer.
• Administrative access to personal and employer data is recorded in an append-only audit log — including data exports and compliance-report generation — capturing who accessed what, at what scope, and when.
• The administrator allow-list is reviewed periodically to enforce least-privilege access.

Data retention and deletion

• When an employee deletes their account, their data is moved to a recoverable state for a short window and then permanently purged by an automated job.
• A minimal, de-identified financial record of any carbon-offset purchase (certificate reference, amount, and date — with no commute detail and not linked to identity) is retained afterwards, solely to meet UK accounting and tax obligations, and is itself deleted once that legal window expires.
• Company customers can have data returned or deleted at the end of their plan, subject to any retention required by law.

Infrastructure and sub-processors

We build on reputable infrastructure providers that maintain their own recognised security certifications (such as ISO 27001 and SOC 2). Each sub-processor is bound by written terms providing an equivalent level of data protection, and personal data is primarily processed within the UK and EEA. Where a provider processes data outside the UK, an appropriate transfer mechanism (such as the UK IDTA or the UK Addendum to the EU SCCs) is in place.

• Vercel — Application hosting and content delivery (USA / EU).
• Neon — Database hosting (account and commute data) (EU).
• Stripe — Payment processing for Business plan subscriptions and carbon offsets (USA / EU).
• Resend — Transactional email delivery (USA / EU).
• AWIN — Affiliate links for low-carbon products (EU / UK).

Resilience and change management

• Backups and the ability to restore availability of personal data in a timely manner after an incident.
• Dependencies are kept current and patched, and changes are reviewed before release.
• Calculation methodology is version-controlled and documented, so emissions figures are reproducible and auditable.

Personal data breach response

We maintain a breach-response procedure. Where a personal data breach affects a company customer's data, we notify the customer without undue delay and provide the information they reasonably need to meet their own notification obligations to the ICO and to affected individuals.

Regulatory posture

Calculate My Product Carbon Footprint Ltd (trading as METIMO) is registered with the UK Information Commissioner's Office (registration ICO:00015440175). We hold Cyber Essentials certification, awarded by the IASME Consortium on 22 September 2026 — certificate 4fe69677-5c59-4ee2-a700-f754bc1e93eb, whole organisation scope, renewal due 22 September 2027. Our controls are also aligned with the principles of ISO 27001 and the requirements of UK GDPR. Where we act as a processor for a company customer, the Data Processing Agreement sets out our respective obligations.

Contact and further information

Security or data-protection questions, and requests for our DPA or further assurance information, can be sent to privacy@metimo.io. We welcome responsible disclosure of any suspected vulnerability at the same address.