This is the complete list. If a company is not on it, we do not send your data there.
Last changed: 1 September 2026. We update this page when the list changes, so a change is something you can see rather than something you have to ask about.
Everything you enter: company details, the name of your authorised signatory, every activity figure, every disclosure answer, and every evidence file you upload.
Your name, your email address, and the session tokens that keep you signed in.
Request logs and IP addresses — and, because it runs the application, every request in transit.
Supplier email addresses, and the buyer and supplier company names in the message.
Carries no identifiers. Industry, country, reporting year, currency, your four scope figures, your country grid factor, and up to five emission-source labels chosen from a fixed list — nothing else. No company name, no person’s name, no email address, no site address, no uploaded file, and no free text you typed. The industry benchmark makes no model call at all.
Which pages you reach and where you stop, recorded against your account identifier. Nothing is loaded or stored until you accept the analytics banner, and declining costs you nothing.
No personal data. DNS records only.
Where a sub-processor is marked as outside the EEA, the transfer is made under the EU Standard Contractual Clauses. The transfer to Anthropic is worth stating precisely, because it is the one people ask about: it carries no identifiers at all — no company name, no person’s name, no email address and no free text. What crosses is your industry, your country, your reporting year, your currency, four emission figures, a grid factor and up to five emission-source labels from a fixed list. That is enforced by a test over the payload, not by a promise in a document.
Each company above is an established provider operating under its own published data processing terms. We are putting the executed agreements for this chain on file as part of incorporation, and this page will say so when that is done rather than before. If you are reviewing us for a procurement process and need the chain today, write to us and we will tell you exactly where each one stands.
privacy@vsmeos.fr — or read the full Privacy Policy, which sets out what we collect, why, and your rights.