One ledger. Every request answered from it.
Customer questionnaires, EcoVadis, your bank, tenders, your auditor. The emissions ledger for European mid-market companies answers each from the same records, and every figure carries its factor, version and licence.
Select a request to see what it needs and what the ledger answers.
Customer questionnaire
For financial years beginning on or after 1 January 2027, a CSRD-obligated customer may not require more from a supplier of up to 1,000 employees, for its own CSRD reporting, than the voluntary standard contains. The request has a ceiling, and the ledger produces the figures inside it.
WHAT THE LEDGER ANSWERS5 of 6, one disclosed
- Scope 1 totalFrom your own combustion, fuel and refrigerant recordsledger
- Scope 2 total, location-basedFrom meter readings, with the grid factor and its versionledger
- Scope 3, if availableCategory 1 spend-based. 4 of 15 modelled, 11 printed as stated omissionsdisclosed
- Energy consumptionFrom the same readings, no second data collectionledger
- Method and periodGHG Protocol, operational control, AR6, the reporting periodledger
- EvidenceFactor, version, licence and audit entry on every lineledger
11 datasets from named public publishers, loaded and licence-reviewed. Every licence cited on the report.
Every source and its licenceWhat each request actually needs, and what the ledger has.
Filled where the ledger answers from its own records. Half-filled where it answers with a disclosed method. Empty where it cannot, and a dash where the request does not ask for that datapoint at all, so you know which is which before the request arrives.
| REQUEST | SCOPE 1 | SCOPE 2 | SCOPE 3 | ENERGY | METHOD | EVIDENCE | BASE YEAR | ASSURANCE |
|---|---|---|---|---|---|---|---|---|
| Customer questionnaireVSME basic module | SCOPE 1: answered from the ledger | SCOPE 2: answered from the ledger | SCOPE 3: answered with a disclosed method | ENERGY: answered from the ledger | METHOD: answered from the ledger | EVIDENCE: answered from the ledger | BASE YEAR: not part of this request | ASSURANCE: not modelled today |
| EcoVadis assessmentenvironment theme | SCOPE 1: answered from the ledger | SCOPE 2: answered from the ledger | SCOPE 3: answered with a disclosed method | ENERGY: answered from the ledger | METHOD: answered from the ledger | EVIDENCE: answered from the ledger | BASE YEAR: not part of this request | ASSURANCE: not modelled today |
| Bank ESG annexcovenant or KYC | SCOPE 1: answered from the ledger | SCOPE 2: answered from the ledger | SCOPE 3: answered with a disclosed method | ENERGY: not part of this request | METHOD: answered from the ledger | EVIDENCE: answered from the ledger | BASE YEAR: answered from the ledger | ASSURANCE: not modelled today |
| Public or private tendercarbon clause | SCOPE 1: answered from the ledger | SCOPE 2: answered from the ledger | SCOPE 3: answered with a disclosed method | ENERGY: not part of this request | METHOD: answered from the ledger | EVIDENCE: answered from the ledger | BASE YEAR: not part of this request | ASSURANCE: not modelled today |
| GRI 305 reportfiled, versioned | SCOPE 1: answered from the ledger | SCOPE 2: answered from the ledger | SCOPE 3: answered with a disclosed method | ENERGY: not part of this request | METHOD: answered from the ledger | EVIDENCE: answered from the ledger | BASE YEAR: answered from the ledger | ASSURANCE: not modelled today |
| ESRS E1 reportfiled, omissions stated | SCOPE 1: answered from the ledger | SCOPE 2: answered from the ledger | SCOPE 3: answered with a disclosed method | ENERGY: not part of this request | METHOD: answered from the ledger | EVIDENCE: answered from the ledger | BASE YEAR: answered from the ledger | ASSURANCE: not modelled today |
| Your auditorread-only, one report | SCOPE 1: answered from the ledger | SCOPE 2: answered from the ledger | SCOPE 3: answered with a disclosed method | ENERGY: not part of this request | METHOD: answered from the ledger | EVIDENCE: answered from the ledger | BASE YEAR: answered from the ledger | ASSURANCE: not modelled today |
| CBAM declarationnot modelled today | SCOPE 1: answered with a disclosed method | SCOPE 2: answered with a disclosed method | SCOPE 3: not modelled today | ENERGY: not part of this request | METHOD: not modelled today | EVIDENCE: not modelled today | BASE YEAR: not part of this request | ASSURANCE: not modelled today |
Assurance is empty on every row on purpose. CoreCanopy produces the evidence an assurance provider asks for; it does not provide assurance, and it will not imply it.
Directive (EU) 2026/470 · in force 18 March 2026 · applies to financial years beginning on or after 1 January 2027
Your customers can ask for exactly this much. Answer it once.
The Omnibus removed the CSRD mandate for most mid-market companies and, for the first time, put a ceiling on what a large customer may require from a supplier of up to 1,000 employees for its own CSRD reporting. An open-ended obligation became a finite one. The ledger is built to produce those figures, and to reuse them.
Does the ceiling protect you?
How a record becomes an answer.
Nothing is retyped. An answer is composed from ledger records, and each record brings its factor, version, licence and audit entry with it. The person receiving it can recompute every line.
LEDGER RECORDSLeeds works · FY2024
CUSTOMER QUESTIONNAIREanswered from the ledger
Illustrative inventory for one site. The factor values, publishers, dataset versions and licences are the real published ones, checked against the release each names; the company, its records and the totals are invented.
Checked against the publisher, not against ourselves.
No customers yet, so no logos. These are checks that have actually run on this system, with the readings they produced, on our own hardware against a local database. The methodology is published, datestamped and versioned.
Also: A local restore drill that brought back 43 forced tables, 59 policies, 394 grants and the deliberate REVOKE UPDATE on filed reports. The managed-database half, and a measured recovery time, are still owed. A one-million-row, 100 MB import read in 19 minutes 15 seconds on a developer machine: 950,000 rows imported and 50,000 quarantined by design, with every cap holding and announcing itself. Zero open dependency advisories and zero suppressions: the allowlist is empty. A route guard that found 34 unreachable API paths the first time it was run by hand, and 7 on its first run inside CI.
Not certified yet. Here is what we do instead.
ISO 27001 and a penetration test are budgeted for after the first paying customers; neither has started and no body or provider has been engaged. We will publish each the day it is signed. Until a certificate is issued we will not display a mark we have not earned. These are the controls that are in force today and can be checked.
Stored and processed in eu-central-1. The sub-processor list is published, and it is short.
You see the request before deciding, you can refuse it, you can end a live session, and you can read every screen we looked at from your own audit trail.
Row-level security on every tenant table, forced rather than merely enabled, and fail-closed. Isolation under simultaneous load is measured on our own hardware rather than asserted.
GDPR erasure runs in the product and returns a receipt naming what was retained and the legal basis for keeping it. Article 15 access is assembled by hand today; the automated surface is not finished, and we would rather say so.
On a paid plan, figures, lineage and the audit trail export as CSV and XLSX and your report PDFs are yours. The free tier keeps full lineage on screen but not the export.
Every action in our AWS account is logged by CloudTrail with tamper-evident log files, kept 400 days. Root use, sign-in without MFA, permission and firewall changes raise an alarm, and GuardDuty watches for threats. Staff actions in the product write to a hash-chained trail.
The database is dumped every night to encrypted, versioned storage in Frankfurt and kept 35 days. Once a month the newest dump is restored into a scratch database and compared with production; the first restore, on 2 October 2026, matched in every table.
Update permission on the report table is revoked at the database, and that revocation came back intact from a local restore drill. The managed-database rehearsal is still owed.
Common questions
Does “answered from the ledger” mean you file EcoVadis for me?
No. CoreCanopy files GRI 305 and ESRS E1 reports. For questionnaires, EcoVadis, banks and tenders it gives you the figures, the method and the evidence, from the same records, so you answer once and reuse it. The submission is yours.
Is this audit-ready?
Ready, yes: the evidence an assurance provider asks for is produced by construction. Audited, no. The external methodology review is budgeted and briefed but not yet commissioned, and we would rather write that than imply a date we have not booked.
What about Scope 3 and CBAM?
Four of fifteen Scope 3 categories today, each naming its method and its data-quality tier; the other eleven print as stated omissions. CBAM needs embedded emissions per product, which the ledger does not model yet. The coverage table says so, so a request does not surprise you.
Which countries can you calculate for today?
Six, and the list is generated from the factor library rather than curated: Australia, France, Germany, New Zealand, the United Kingdom and the United States. A country qualifies only when it can supply grid electricity, natural gas and diesel, which is the floor for finishing a Scope 1 and 2 inventory. India is deliberately absent, and not because of a closed data window: India’s national publisher gives grid electricity and no natural gas or diesel factor, so an Indian company could finish Scope 2 and never finish Scope 1. Ember supplies grid factors for roughly 190 countries, and a grid factor alone does not let a company finish an inventory, so it does not open a country.
What if my customer asks for more than the cap allows?
You can answer within the ceiling and point to it. The ledger produces the figures the basic module asks for from your records; anything beyond it is your choice to provide, not an obligation. The ceiling covers what is asked for CSRD reporting, so a purely commercial request sits outside it.
Do I pay per user?
Never. Users are unlimited on every tier including the free one. An accurate inventory needs several people entering data, and charging per seat is charging for completeness. An auditor is a separate role rather than a member of your organisation, so auditor access does not consume a seat either.
Bring your last spreadsheet and the last request you got. Leave with the answer.
A working session, not a demo. Forty minutes with your footprint file and a real questionnaire: which fields the ledger answers from it today, which it cannot, and what it would take.