Security & Trust
How the product controls access, keeps evidence connected to decisions, and puts people in charge of sharing.
Company access boundaries
Workspace routes require authentication. Company membership and permissions are checked when accessing company-owned records. Administrators can manage memberships, and agent connections have their own approval and revocation workflows.
Keep permissions current and review access when team responsibilities change.
Private evidence access
Document downloads and previews use authenticated endpoints with file authorisation checks. Delivery depends on the storage configuration; private object-storage delivery uses short-lived signed links.
Treat downloaded files as confidential. Access controls within ESG Hero do not control copies saved or forwarded outside the workspace.
Review and traceability
Review queues let people check extracted information before confirming records. Reporting workflows connect facts with evidence, review states and version history. Audit views help teams trace supported actions and changes.
Traceability helps a reviewer understand a figure; it does not certify that the underlying evidence or reporting conclusion is correct.
Document lifecycle
Private evidence supports retention schedules, deletion requests and legal holds. Deletion is subject to the applicable schedule and hold state, with lifecycle actions recorded for review.
For the proposed data-handling notice and remaining policy details, read the Privacy Policy draft.
Security questions and due diligence
This page describes product controls. It does not claim an independent certification, a completed penetration test, an uptime guarantee or a particular data-residency commitment.
If you need deployment-specific information, contractual assurances or to report a concern, use the Security contact on the Contact Us page when available.