ThemisIQ · Trust & Data

We know trust is everything.
Here is exactly how we earn it.

You are entering sensitive compliance data into ThemisIQ: emissions figures, workforce data, supplier relationships, AI systems. We take that responsibility seriously. This page explains exactly what we do with your data, what we never do, and what rights you have.

Questions? Contact us at privacy@themisiq.co

Our core data principles
1
Your data belongs to you
Everything you enter into ThemisIQ (your emissions data, workforce figures, supplier information, AI systems, financial data) belongs to you. We are custodians of your data, not owners. You can export or correct it at any time, and ask us to delete it.
2
We never sell or share your data
ThemisIQ does not sell, rent, share, or license your data to any third party, ever. Your compliance data is not used for benchmarking products sold to others, not shared with industry bodies, and not disclosed to regulators on your behalf without your explicit instruction.
3
Where we use AI
ThemisIQ uses AI in exactly one place, through our AI provider Anthropic: reading the figures off documents you upload to the Bill Review add-on. Nothing else in the platform uses it. Framework classification and risk scoring are rules-based, and the rules are published on our methodology page.
4
Your data is never used to train AI models
Your data is never used to train, fine-tune, or improve any AI model, including the models behind those two features. Each session is processed in isolation.
5
Encrypted in transit and at rest
All data transmitted to and from ThemisIQ is encrypted using TLS 1.2+. All data stored in ThemisIQ is encrypted at rest using AES-256. Our infrastructure runs on Supabase (hosted on AWS) with SOC 2 Type II certified data centres.
6
Who can access your data
ThemisIQ enforces row-level security, so your data is technically isolated from other customers at the database level rather than only by application logic. Production access is restricted to a small number of named individuals who require it to operate the platform, each with multi-factor authentication enrolled. There is no support organisation with standing access to your data, and no third party administers the platform on our behalf. Access is granted by name, not by role, and removed when it is no longer required. Our staff who review bills open the bills you upload through our review tools, to read them for inventories read by a ThemisIQ specialist, and every opening in those tools is logged.
What we collect
Account data
Name, email address, company name, role. We use these to create and manage your account.
Compliance data
GHG emissions figures, workforce data, supplier information, AI system descriptions, and other data you enter into ThemisIQ wizards. We use it only to generate your compliance outputs.
Usage data
Which features you use, when you log in, which modules you access. We use it to improve the platform and provide support.
Payment data
Payment is processed by Stripe. ThemisIQ does not store credit card numbers or bank account details.
What we never collect
Sensitive personal data
ThemisIQ does not collect personal data about your employees beyond aggregate workforce metrics (headcount, pay bands). Individual employee data is never stored.
Third-party tracking
ThemisIQ does not use advertising trackers, third-party analytics pixels, or behavioural profiling tools.
Biometric or health data
ThemisIQ does not collect any biometric, health, or special category personal data.
How long we keep your data
Active account data
Kept for the duration of your subscription plus 12 months, to allow for year-on-year comparison reporting.
Deleted account data
When you ask us to delete your account, all compliance data is permanently deleted within 30 days. Account records are retained for 7 years for legal and tax purposes.
Support conversations
Support emails and chat logs are retained for 2 years.
Your rights
Access
Email privacy@themisiq.co to request a copy of all data ThemisIQ holds about you. We provide it within 30 days.
Correction
You can correct any inaccurate data directly in the platform or by contacting us.
Deletion
To delete your account and all associated compliance data, email privacy@themisiq.co. We complete the deletion within 30 days and confirm in writing when it is done.
Portability
All compliance outputs are available as CSV exports, so your data is never locked in a proprietary format.
Objection
You can object to any processing of your data that is not strictly necessary to provide the service.
Regulatory compliance
PIPEDA
Canada (federal)
ThemisIQ Compliance Inc. is a Canadian corporation. PIPEDA is our primary privacy law.
Quebec Law 25 (Bill 64)
Quebec, Canada
ThemisIQ complies with Quebec's enhanced privacy requirements including privacy impact assessments and breach notification.
GDPR / UK GDPR
European Union · United Kingdom
For customers in the EU and UK, ThemisIQ acts as a data processor. A Data Processing Agreement (DPA) is available on request.
CCPA / CPRA
California, USA
ThemisIQ does not sell personal information. California residents have the right to know, delete, and opt out of sale (not applicable as we do not sell data).
CASL
Canada
ThemisIQ complies with Canada's Anti-Spam Legislation for all commercial electronic messages.
Infrastructure & security
ThemisIQ holds neither SOC 2 nor ISO 27001 today
The certifications named below are held by our subprocessors, not by ThemisIQ. Our own SOC 2 Type I, SOC 2 Type II and ISO 27001:2022 are in progress: current status and target dates.
Hosting
Supabase on AWS (us-east-1): Supabase holds SOC 2 Type II certification
Encryption in transit
TLS 1.2+ on all connections
Encryption at rest
AES-256 on all stored data
Authentication
Supabase Auth with email verification · MFA available
Access control
Row-level security: data isolated at database level
Payment processing
Stripe: Stripe holds PCI DSS Level 1 certification
Email
Resend: Resend holds SOC 2 Type II certification
Frontend
Vercel: Vercel holds SOC 2 Type II certification
AI provider
Anthropic: Bill Review document reading only
Questions about your data?
Contact our privacy team at privacy@themisiq.co. We respond within 2 business days. For data deletion requests, we act within 30 days.
Our methodologies →Full privacy policy →