Give your auditor a login, not a folder.
This page is written for the assurance provider rather than for the company engaging them. If you are auditing a CoreCanopy inventory, this is what you get and what you can check.
The access itself
- Read-only, enforced at the request layer rather than by hiding buttons. Every figure’s trace and the audit chain are open to you. Nothing can be changed.
- Scoped to one report. The grant carries the scope; it is not a parameter you or anyone else can widen.
- A single-use link. The acceptance code is shown once, to the person who created the grant, and we store only its hash.
- Time-boxed. The grant carries its own expiry and the database evaluates it on every read, so an expired grant cannot outlive its window through a cached permission.
- The company can end your access at any time, and you are told when it has been ended rather than meeting a blank screen.
What is not built yet
Stated here rather than left for you to discover, because you are the reader most likely to test every sentence on this page. Live today: the grant, its scope, its expiry, the single-use link, the read-only enforcement, and the figure-level trace. Not yet live: the dedicated read-only portal you sign into, and the in-app screens the company uses to issue and revoke your access. Those are done by us on the company’s instruction today, and each grant and revocation is written to their audit chain.
One more, because it is the kind of thing that matters to you specifically: your individual page views are notyet written to the company’s audit chain. Support sessions by our own staff are. This page previously implied both, and it was wrong about you.
An auditor here is a first-class subject in the authorization model, not a user account with extra flags: a separate principal type with no row in the users table and no membership in the organisation. That distinction matters. Were an auditor merely a member, they would see every report the organisation had ever filed, and an assurance surface whose scope is a request parameter is one forgotten filter away from being a tenant-wide read.
What your assurance provider will ask for.
Six questions, in the order they usually arrive, and where each one is answered.
Open it. The activity rows, the quantity as entered, any unit conversion, the factor with its publisher, dataset version and valid window, the GWP basis, and the per-gas result wherever the publisher provides a split.
The resolver records its deliberation against the result, in the same transaction that writes the figure: what decided it, which region level it used, how many candidates it weighed, and the runners-up. The trace shows the first three today; the runners-up are recorded and in the export, and the screen for them is still being built.
Both, with timestamps. Imported rows land needing review and stay out of the totals until a named person accepts them.
Each audit entry cites the hash of the entry before it. You can run the check yourself from inside the product and see the sequence range it covered, so a gap or a break is visible rather than asserted away.
The completeness register, generated from the organisation’s own sites and declarations, plus the stated-omissions page printed on the report itself.
An evidence export in CSV and XLSX, with the licence of every factor cited, so your working papers do not depend on our continued existence.
What we do not claim
CoreCanopy does not provide assurance and does not describe its own output as audited, assured or verified. An external review of the calculation methodology by an independent practitioner is budgeted and briefed but not yet commissioned: nobody is engaged and no date is set. Until it has taken place we describe the output as ready, and the distinction is deliberate.
Four of fifteen Scope 3 categories are modelled. Category 1 is spend-based on USEEIO, whose factors are denominated per United States dollar, so for a non-US organisation it is a United States economic proxy applied to converted spend, and the methodology note on the figure says so. Market-based Scope 2 currently falls to a disclosed grid fallback because the European residual mix dataset is not licensed to us. Biogenic CO₂ is held separately in the ledger but is not yet printed on the filed report.
Auditor access does not consume a seat. An auditor is a separate subject type rather than a member of the organisation, so granting you access costs the company nothing and users are unlimited on every tier regardless. We would rather you were in the system looking at lineage than reconciling a spreadsheet someone exported for you.