Senseible White Paper
Every figure traceable to its source. How Senseible turns tax invoices and utility bills into greenhouse-gas figures: the accounting equations, emission factor governance, uncertainty, where AI is and is not used, the audit trail, data protection and known limits. Please read the Legal Disclaimer at the end.
1. Intended use and limits
Senseible converts business documents such as tax invoices and utility bills into greenhouse-gas activity records, calculates emissions with published factors, and keeps an evidence trail for each figure.
| Senseible is | Senseible is not |
|---|
| A baselining, screening and evidence-management tool | An assurance provider, auditor, verifier or accredited body |
| A calculator producing estimates with stated uncertainty | A source of certified or third-party-verified figures |
| A preparer of framework-aligned report drafts | A carbon registry, exchange or credit issuer |
| A data-preparation aid for customers reporting under carbon-border and disclosure regimes | A substitute for installation-level monitoring plans and accredited verification where a regime requires them |
All reports are self-declared by the customer. Acceptance by any regulator, lender, investor or buyer is not guaranteed.
How to read the equations. Where this paper uses a formula, the sentence or paragraph right after it explains it in plain English. Numbers in worked examples are illustrative round values chosen to show the arithmetic. They are not published emission factors. Symbols are listed in Appendix A and sources in Appendix B.
2. Accounting method
- Framework. Calculations follow the accounting principles of the GHG Protocol Corporate Standard, Scope 2 Guidance and Scope 3 Standard. Scope 1: direct combustion and process sources. Scope 2: purchased electricity, energy, heat. Scope 3: other value-chain activity.
- Scope 2. Location-based and market-based results are reported as separate figures where the customer supplies the instrument data needed for market-based accounting.
- Calculation. Emissions equal activity quantity multiplied by an emission factor. A line is calculated only when activity category, quantity, unit and a matching registry factor are all present. Quantities are never inferred from monetary amounts for Scope 1 and 2 activity.
- Scope 3. Where only spend data exists, a spend-based method is used and labelled as such. Spend-based results carry materially wider uncertainty than activity-based results and are presented with that range.
- Avoided emissions and offsets. Reported separately, with their methodology stated. They are never subtracted from the Scope 1, 2 or 3 inventory.
- Direct measurement. Invoices record purchases, not consumption. Sources such as refrigerant leakage, process emissions and captive generation are calculated only when the customer supplies the underlying measured or metered data.
2.1 The core equation
Equation (1): E = A × EF
In plain English. Emissions (E, in kilograms of CO₂-equivalent) equal the amount of activity (A: litres of fuel, kilowatt-hours, tonne-kilometres) multiplied by an emission factor (EF: kilograms of CO₂-equivalent released per unit of that activity). For example, 100 litres of a fuel with an illustrative factor of 2.5 kgCO₂e per litre gives 100 × 2.5 = 250 kgCO₂e. This is the form the IPCC and the GHG Protocol use for fuel combustion and purchased energy.
Equation (2): EFCO₂e = EFCO₂ + GWPCH₄ · EFCH₄ + GWPN₂O · EFN₂O
In plain English. Burning a fuel releases carbon dioxide, a little methane and a little nitrous oxide. Each gas warms the climate by a different amount, so each is multiplied by its Global Warming Potential (GWP), which compares one kilogram of that gas with one kilogram of CO₂ over 100 years, and the results are added. Under IPCC Sixth Assessment Report values, GWPCH₄ is 29.8 for fossil methane and 27.0 for non-fossil methane, and GWPN₂O is 273. The GWP set used (for example AR5 or AR6) is stored on every line, and one total never mixes sets.
Equation (3): EFCO₂ = CC × OF × 44 / 12
In plain English. Background on where a combustion factor comes from. Carbon is conserved: the carbon in the fuel (CC, kilograms of carbon per unit of fuel) that actually burns (OF, the oxidation fraction) leaves as CO₂. Each kilogram of carbon becomes 44/12, about 3.67, kilograms of CO₂ because CO₂ is heavier than carbon alone (molar masses of about 44 and 12 g/mol). Senseible applies published factors from its registry. It does not substitute its own figures for them.
2.2 Activity types and their equations
Equation (4): Afreight = (m / 1000) × d E = Afreight × EFₜₖₘ
In plain English. Freight is measured in tonne-kilometres: the mass moved (m, kilograms, divided by 1000 to get tonnes) times the distance (d, kilometres). Moving 30,000 kg over 1,400 km is 30 × 1,400 = 42,000 tonne-kilometres. At an illustrative 0.05 kgCO₂e per tonne-kilometre that is 2,100 kgCO₂e.
Equation (5): Espend = S × EFspend
In plain English. When no quantity is available, money spent (S) is multiplied by an average factor for that kind of purchase (kilograms of CO₂e per unit of currency). This is the spend-based method in the GHG Protocol Scope 3 guidance. It is only an average over many products, so its uncertainty is much wider than an activity-based figure. Senseible labels it as spend-based and shows the range.
Equation (6): Elocation = Σₚ kWhₚ × EFgrid,p Eₘₐᵣₖₑₜ = Σᵢ kWhᵢ × EFᵢ + kWhᵣₑₛ × EFᵣₑₛ
In plain English. Purchased electricity is reported two ways. The location-based figure multiplies each period's kilowatt-hours (p runs over periods) by the average factor of the local grid. The market-based figure multiplies the kilowatt-hours covered by each contractual instrument i (a certificate, power purchase agreement or supplier contract) by that instrument's factor, and multiplies the remaining uncovered kilowatt-hours, kWhᵣₑₛ = kWhₜₒₜₐₗ − Σ kWhᵢ, by a residual-mix factor. Each instrument can be counted only once, and cannot cover more than was consumed. Illustration: 10,000 kWh, of which 6,000 kWh are covered by an instrument with factor 0, a grid factor of 0.80 and a residual factor of 0.90 gives a location-based 8,000 kgCO₂e and a market-based 4,000 × 0.90 = 3,600 kgCO₂e. The GHG Protocol Scope 2 Guidance requires both to be reported where market-based data exist.
Equation (7): T = E₁ + E₂ + E₃ (avoided emissions R reported beside T, never T − R)
In plain English. The inventory total is the sum of Scope 1, 2 and 3. Reductions elsewhere (avoided emissions, offsets) are shown as a separate line with their method, and are not deducted from the inventory, which keeps the total comparable between companies and years.
2.3 Units and the physics of a valid quantity
An emission factor is defined per physical unit, so before equation (1) is applied the quantity read from a document must be in the factor's unit and must measure the same physical thing.
Equation (8): Ac = kᵤ × Aₚ
In plain English. The printed quantity (Aₚ) is converted to the unit of the factor (Ac) with a fixed multiplier (kᵤ): 1 for kilowatt-hours, 1,000 from megawatt-hours to kilowatt-hours, 1,000 from kilolitres to litres and 1,000 from tonnes to kilograms. A multiplier exists only between units of the same kind. If a document gives litres and the factor is per kilogram, there is no multiplier, so the line gets no figure. A density is used only where it is written into the factor record itself (equation (13)).
Equation (9): EFgrid = (Σg Mg) / (Σg Gg)
In plain English. A location-based grid factor is the carbon dioxide emitted by the power stations feeding a grid (Mg for station g) divided by the electricity they supplied (Gg). It averages coal, gas, hydro, nuclear, solar and wind generation together, which is why every kilowatt-hour drawn from the same grid in the same period carries the same factor. Senseible takes this value from the national grid authority's published database (Section 3). It does not compute or adjust it.
Equation (10): kVA² = kW² + kvar² kW = kVA × cos φ kWh = kVAh × mean(PF)
In plain English. Alternating current carries real power (kW), which does useful work and is what power stations burn fuel to produce, and reactive power (kvar), which flows back and forth to keep motors and transformers magnetised without being used up. Together they make apparent power (kVA). For a sinusoidal supply the three form a right-angled triangle, and the cosine of the angle φ between real and apparent power is the power factor. Over a billing period they add up to kWh, kvarh and kVAh. Grid emission factors are per kWh of real energy. Some industrial tariffs bill in kVAh, and turning kVAh into kWh needs the period's average power factor (mean(PF)), which is itself defined as kWh divided by kVAh, so the bill's own kWh reading is needed. Illustration: 10,000 kVAh at an average power factor of 0.95 is 9,500 kWh; treating it as 10,000 kWh would overstate emissions by about 5%. Senseible records kVAh and kvarh lines in their own unit, applies no grid factor to them, and notes why on the result.
Equation (11): kWhₙₑₜ = kWhᵢₘₚₒᵣₜ − kWhₑₓₚₒᵣₜ
In plain English. A rooftop-solar customer on net metering may see one figure that is grid import minus solar export. Scope 2 counts electricity bought from the grid, so the import reading is needed; the net figure understates it. Exported solar is a separate quantity, reported if at all as avoided emissions beside the inventory (equation (7)), never deducted from it. Senseible does not treat net units as consumption and notes on the result that import units are needed.
3. Emission factor governance
- Registry. Every factor is held in a versioned registry with its value, unit, geography, gas basis, Global Warming Potential set, publisher, source document, publication year and validity period.
- Sources. Primary publications only: national grid authority databases, IPCC guidelines and emission factor database, national government conversion-factor sets, and the International Energy Agency for other countries.
- No factor, no figure. If no registry factor matches an activity, the line returns no result and is flagged. The system does not estimate or substitute a similar factor.
- Pinning. Each result stores the factor identifier, source, year and methodology version in force when it was calculated. Later factor updates do not alter stored results; recalculation creates a new, linked record.
Equation (12): Aₖ = A × dₖ / d E = Σₖ Aₖ × EFₖ
In plain English. A factor is valid only for a stated period. When a bill covers days from two validity periods, the quantity is split in proportion to days (dₖ days in period k, out of d days in total) and each part uses the factor valid for its own period. A 30-day bill with 12 days in the first period puts 40% of the kilowatt-hours under the first factor and 60% under the second. If no factor exists, the result is left empty, which is different from zero. A missing factor never turns into a silent 0.
3.1 From a published default to a factor per kilogram or litre
Equation (13): EFₘₐₛₛ = EFenergy × NCV EFᵥₒₗ = EFₘₐₛₛ × ρ
In plain English. Fuel tables give CO₂ per unit of energy (kilograms per terajoule), but invoices give kilograms or litres. The net calorific value (NCV, the energy released per unit of mass) turns the first into CO₂ per kilogram, and the density (ρ, kilograms per litre) turns that into CO₂ per litre. Where a density is needed it is an assumption, written into the factor record with its value, and a supplier's measured value should replace it.
Worked derivation (IPCC 2006 default values). LPG has a default carbon content of 17.2 kg of carbon per gigajoule. By equation (3), with full oxidation as the IPCC defaults assume, that is 17.2 × 44/12 ≈ 63.1 kg CO₂ per gigajoule, the tabulated 63,100 kg per terajoule. With an NCV of 47.3 gigajoules per tonne, one kilogram of LPG gives 63.1 × 47.3 / 1,000 ≈ 2.98 kg CO₂. Residual fuel oil (furnace oil) gives 77.4 × 40.4 / 1,000 ≈ 3.13 kg CO₂ per kilogram; at an assumed density of 0.95 kg per litre, about 2.97 kg CO₂ per litre. Naphtha is published per mass only, so it is kept per kilogram and a naphtha line in litres gets no figure. These are the carbon-dioxide parts of the factors; equation (2) shows how methane and nitrous oxide are added where a registry factor includes them.
4. Uncertainty and data quality
- Range reporting. Each line carries a low, central and high value derived from the factor's published uncertainty. Totals combine lines using error propagation, and the range is shown beside every total in the dashboard, exports and reports.
- Data-quality flags. Missing fields, unit anomalies, unclassified items and low extraction quality reduce a documented data-quality score. The score measures completeness and consistency of inputs. It does not measure the accuracy of the underlying facility.
- Consistency status. Records are labelled internally consistent, needs review, or insufficient data. "Internally consistent" means the record passed the system's rule checks. It does not mean independently verified.
Equation (14): uE = √(uA² + uEF²)
In plain English. For a single line, E = A × EF. If the activity data are uncertain by uA (as a fraction, for example 0.05 for 5%) and the factor by uEF, and the two errors are independent, the line's relative uncertainty is the square root of the sum of their squares. This is the IPCC (2006) rule for multiplying independent quantities. Squaring means the larger error dominates: 5% and 3% combine to about 5.8%, not 8%.
Equation (15): Var(Eₜₒₜ) = Σf [ (Σi∈f Aᵢ)² σf² + EFf² Σi∈f σA,i² ] Uₜₒₜ = √(Var(Eₜₒₜ)) / Eₜₒₜ
In plain English. Many lines can use the same emission factor f. A factor's error is the same error repeated on every line that uses it, so it must be added once on the combined quantity, not once per line. In the formula, the first term is the factor's error (σf) applied to the summed activity of all lines using it. The second term is each line's own activity error (σA,i), which is independent between lines. The square root of the variance, divided by the total, is the relative uncertainty Uₜₒₜ. This follows the standard propagation law in the ISO/IEC Guide 98-3 (GUM) and IPCC Approach 1, with correlation of the shared factor included.
Worked example (illustrative). Two lines share one factor of 2.0 with 3% uncertainty. Line 1 has 100 units and line 2 has 200 units, each with 5% activity uncertainty. The total is 2.0 × 300 = 600. The variance is 300² × 0.06² + 2.0² × (5² + 10²) = 324 + 500 = 824, so the standard deviation is 28.7, which is 4.78% of the total. Treating the two lines as fully independent would give 4.35% and understate the uncertainty by about 10%. For a range at roughly 95% coverage (coverage factor 1.96, assuming a normal distribution), the total is about 600 ± 56, or 544 to 656.
Limits of this method. It is a first-order approximation. It is reliable when relative uncertainties are modest (IPCC guidance treats about 30% as the practical limit) and assumes activity errors are independent between lines. For larger or asymmetric uncertainties, the IPCC recommends Monte Carlo simulation (Approach 2). Factor uncertainties are those published by the factor's source. Senseible does not generate its own.
Figure 1. Why a shared emission factor sets a floor on total uncertainty. Relative uncertainty of a total when n equal lines share one factor (3%), each with 5% independent activity uncertainty. The total follows U = √(u_F² + u_A²/n) and cannot fall below the factor's own uncertainty. Move the sliders to try other values.
Equation (16): Q = max( 0 , min( 100 , 100 − Σₖ pₖ · nₖ ) )
In plain English. The data-quality score starts at 100 and loses points each time a documented check flags a problem: nₖ is how many times flag k occurred (for example a missing quantity or an unclassified item), and pₖ is that flag's penalty, held in versioned configuration. The score is kept between 0 and 100. Because it is a fixed rule, the same document always scores the same. It describes the completeness of the paperwork, not the true emissions of a site.
4.1 The checks a record passes before it is accepted
Equation (16) is applied to every emission line with these penalties, the values in force in the current methodology version:
| Check (flag k) | Penalty pₖ |
|---|
| Activity quantity missing, zero or negative | 20 |
| Activity unit missing | 15 |
| Emission factor missing | 10 |
| Quantity unusually high for one record (above 1,000,000 units, or 100,000,000 kWh for grid electricity) | 25 |
| Source document read with extraction confidence below 70 out of 100 | 15 |
Equation (17): line passes if Qᵢ ≥ 80 Fₚₐₛₛ = nₚₐₛₛ / n
In plain English. A line passes when its score Qᵢ is 80 or more, so any combination of flags costing more than 20 points fails it. Fₚₐₛₛ is the share of the n lines in a batch that pass. Score alone is not enough: the evidence gate below runs first.
Before scoring, an evidence gate requires every line to have its source document and that document's SHA-256 fingerprint; a scope of 1, 2 or 3; an activity classification, quantity and unit; an emission factor with its source and the source line it was read from; and a calculated result. A factor written by the current methodology must equal the published registry value for its source. Scope 3 lines are checked line by line in the supplier evidence trail instead. The stored result must also recompute:
Equation (18): | A × EF − E | ≤ max( 0.01 , 0.001 · E )
In plain English. Quantity times factor must reproduce the stored emissions to within 0.1%, or 0.01 kg for very small values. The stored number is re-derived rather than trusted, so an edited or corrupted result cannot pass.
Each batch also receives a screening risk level (low, medium or high) from patterns that are unusual in genuine records, such as a high share of whole-number results, missing invoice numbers, low average line scores, or one identical factor across many fuel lines. The weights are part of the methodology documentation described in Section 12. The status then follows:
| Status | Rule |
|---|
| Insufficient data | Any line misses a field required by the evidence gate |
| Internally consistent | Fₚₐₛₛ ≥ 0.8 and risk low |
| Needs review | Fₚₐₛₛ ≥ 0.5 and risk not high |
| Not accepted | Any other case |
In the app the internally consistent status is labelled Verified. As stated above, it means the batch passed these rule checks, not that it was independently verified. The same rules run in the preview offered to visitors who are not signed in, which records nothing.
5. AI architecture and boundaries
Principle. AI reads and explains; deterministic code classifies, calculates and scores.
| Layer | Function | Control |
|---|
| Extraction | A vision-capable language model reads a document image and returns structured fields. | Fixed output schema. Minimum-variability settings. Absent fields return null; the model may not infer quantities, units or codes. |
| Classification | Rule-based mapping by full tax-code match first, then whole-word keyword match only when the unit agrees. | Ambiguous or unmatched items are marked for review, never guessed. |
| Plausibility checks | Unit conversion and quantity-price-total consistency checks. | Failures block calculation and route the line to review. |
| Calculation and scoring | Registry factors applied by versioned code. | Same input gives the same output. No model influence. |
| Human review | Reviewers confirm or override flagged lines. | Every override records who, when, what changed and why. |
| Advisory chat and recommendations | Language models explain results and suggest improvements. | Text only. Figures come from the signed-in user's own records. The models cannot alter figures, scores or status, and are instructed not to estimate missing values or claim certification. |
Model text output cannot be guaranteed identical between calls. Repeatability is enforced by the system: a document already processed is returned from stored results or rejected as a duplicate, not reprocessed.
5.1 How the language model is constrained
Equation (19): yₜ = argmaxᵥ P( v | y<t, image, instructions )
In plain English. A language model writes its answer one token (a word fragment) at a time. At each step it scores every possible next token, P(v | everything so far). At temperature 0 it always takes the highest-scoring token (argmax) instead of sampling at random, which removes sampling randomness. This lowers variability but does not guarantee identical text across model versions or hardware, which is why results are stored and reused. The reply must fit a fixed schema of named fields, and a field that is not clearly visible must be null. The model's output is treated as untrusted input: every field must pass the checks below before it reaches a calculation.
Equation (20): | q × r − a | ≤ τ τ = ½ · 10^(−dq) · r + ½ · 10^(−dᵣ) · q + ½ · 10^(−dₐ)
In plain English. A consistency check on every invoice line: quantity (q) times unit rate (r) should equal the printed line amount (a), apart from rounding. Printed numbers are rounded, so the allowed gap τ is not a guess. It is the largest error that rounding alone could cause: a value printed with d decimals can be off by up to half of the last digit, and the rate's error is multiplied by the quantity and vice versa. Example: quantity 1,250.50 and rate 91.25 (two decimals each) give 114,108.125; the printed amount 114,108.13 differs by 0.005, well inside τ = 6.71375, so the line passes. A line that fails is not calculated and goes to a reviewer.
Long documents. One extraction call reads at most 10 pages, so a longer PDF is read in parts.
Equation (21): Nₚₐᵣₜₛ = ⌈ npages / 10 ⌉ page = page′ + 10 · (j − 1)
In plain English. A document of npages pages is split into Nₚₐᵣₜₛ parts, rounding up: a 23-page PDF becomes 3 parts (pages 1 to 10, 11 to 20 and 21 to 23). The model reports page numbers within its part (page′), and the system maps each back to the original by adding the pages before part j, so every line still points to its true source page. A document whose page count cannot be read is rejected rather than guessed.
5.2 How the advisory assistant is grounded
The assistant does not recall figures from memory. For a signed-in user, application code queries that user's own records on the server, using the authenticated identity rather than anything typed in the request, and places the results in the model's context. The model is told to use only those figures and to say so when a figure is absent. Visitors who are not signed in receive no user data. Nothing the assistant writes is stored as a record, so it cannot change a calculated number.
Text taken from documents and profiles is placed inside a delimited data block, and the model is instructed that anything inside it is data, never instructions, so an instruction hidden in an invoice cannot redirect the assistant. Replies are checked before they are shown, and a reply that repeats internal instructions is replaced.
5.3 Projections the assistant may quote
When a signed-in user's records cover at least four months, the assistant may quote a 12-month projection. It is computed by code, not by the model, and is always labelled Projection.
Equation (22): β₁ = (Σₜ (t − t̄)(yₜ − ȳ)) / (Σₜ (t − t̄)²) β₀ = ȳ − β₁ t̄
In plain English. Each month's total emissions (yₜ, where t counts calendar months so that gaps keep their real spacing) is fitted with the straight line that minimises the squared distances to the points: ordinary least squares over up to the last 12 months. β₁ is the trend in kilograms per month and β₀ is the line's level at the first month.
Equation (23): Ŷ = Σk=1…12 max( 0 , β₀ + β₁ (tₗₐₛₜ + k) ) range = Ŷ ± 1.28 · sᵣ · √(12) sᵣ = √(Σₜ rₜ² / (n − 2))
In plain English. The line is extended 12 months past the last month and the months are added, with any negative month counted as zero. The range uses the scatter of past months around the line (sᵣ, computed from the residuals rₜ with n − 2 because two parameters were fitted): for twelve independent months the spread of the sum grows with √12, and ±1.28 standard deviations covers about 80% of a normal distribution. The range leaves out uncertainty in the fitted line itself and any change in the business, so it is narrower than the true uncertainty, especially with few months. A projection describes the past trend. It is not a forecast, target or commitment.
6. Evidence and audit trail
- Each uploaded file is identified by a SHA-256 hash of its full contents.
- Each calculated line records document hash, factor identifier and source, methodology version, flags, quality score and status.
- The compliance ledger and security audit log are append-only, and entries are hash-chained so alteration is detectable.
- Customers can export the full trail from source document to reported figure.
Equation (24): h = SHA-256( file bytes ) ∈ {0,1}²⁵⁶ hᵢ = SHA-256( hᵢ₋₁ ‖ eᵢ )
In plain English. SHA-256 (standardised in NIST FIPS 180-4) turns any file into a 256-bit fingerprint. Change a single character in the file and the fingerprint changes completely, so identical fingerprints mean identical files for all practical purposes; the chance that two different files share one is at most about n²/2²⁵⁷ for n files, which is about 4 × 10⁻⁵⁴ for a trillion files. The second formula chains the ledger: each entry's hash (hᵢ) is computed from the previous hash (hᵢ₋₁) joined (‖) to the new entry (eᵢ). Altering or removing an old entry changes every hash after it, so tampering is detectable. A hash chain detects changes; it does not by itself prevent them.
6.1 Data model
Figure 2. How a figure links back to its document. Data model. Tap an entity to see what it holds and what it links to. Factors are never edited in place; a new version is added.
| Entity | What it holds | Linked to |
|---|
| Document | Full-file hash, type, dates, supplier and tax identifiers, extraction output, source reference | One or more line items |
| Line item | Description, tax or classification code, quantity, unit, amount | One emission line |
| Emission line | Scope, category, activity quantity and unit, result with low, central and high values, status, flags, quality score | One factor; one ledger entry |
| Emission factor | Value, unit, geography, gas basis, GWP set, publisher, source document, year, validity period, version | Many emission lines |
| Ledger entry | Hashes, factor and methodology version in force, status, reviewer actions | Emission line; previous entry |
Relationships: Document (1) → Line items (many) → Emission line (1 each) ← Factor (1 per line). Factors are never edited in place; a new version is added.
7. Document data flow
Figure 3. Where AI is used, and where it is not. Document data flow. Only step 3 uses a language model. Every other step is deterministic, versioned code, with human review for flagged lines.
| Step | Stage | Behaviour |
|---|
| 1 | Upload | File sent to the processing service over an encrypted connection. |
| 2 | Identity | Signed-in requests are validated server-side. Unauthenticated use is limited to a separate, time-limited guest session. |
| 3 | Hash and duplicate check | Full-file hash; duplicates are not reprocessed. |
| 4 | Extraction | AI extraction; one retry on a more capable model if the output is unusable. |
| 5 | Relevance check | Non-business documents are rejected. |
| 6 | Classification and checks | Rule-based classification and plausibility checks. |
| 7 | Calculation | Registry factors applied; ranges computed. |
| 8 | Review and storage | Flagged lines reviewed; results stored with the full trail. |
8. Data security
- Authentication and authorisation. Managed identity service with server-side token validation. Every server function validates the caller. Roles are held separately from profiles.
- Tenant isolation. Database Row-Level Security is enabled on every table. Signed-in users can read and write only their own records. Team data is additionally scoped by organisation membership.
- Guest sessions. Guest data and cached results are scoped to the originating session and time-limited.
- Storage. Document storage is private, with access limited to the owning account.
- Encryption. Encryption in transit and at rest on managed infrastructure, as stated in our Privacy Policy.
- Secrets and origins. Service credentials exist only in server-side environments. Cross-origin access is restricted to Senseible's own domains.
- Payments. Payment signatures are verified server-side and matched to the authenticated user. Card data is handled by the payment processor.
- Logging. Security events go to an access-restricted audit log. Logs do not record document contents.
9. Data protection
| Topic | Position |
|---|
| Legal framework | Designed to align with India's Digital Personal Data Protection Act, 2023, and GDPR principles where applicable. |
| Roles | Data Fiduciary/Controller for direct users. Data Processor for enterprise and institutional customers under a Data Processing Agreement, acting on documented instructions. |
| Sub-processors | Cloud infrastructure, AI model, voice, payment and analytics providers, under contractual confidentiality and data-protection obligations. Document images are sent to AI model providers for extraction. The current list is available on request. |
| Breach notification | Confirmed personal data breaches are notified to the Controller without undue delay and within 72 hours of awareness. |
| Retention | Unauthenticated data: up to 3 months. Authenticated or paid data: up to 18 months, unless law or contract requires otherwise. |
| Deletion and return | On termination, personal data is deleted or returned, subject to legal retention and to data irreversibly anonymised. |
| Model improvement | Governed by the Privacy Policy and customer contract. Users may opt out of future training. Enterprise customers can set specific terms in the Data Processing Agreement. |
| User rights and grievances | Access, correction, deletion, withdrawal of consent and grievance redressal, as set out in the Privacy Policy. |
| Ownership | Customers retain ownership of their raw input data. |
10. Error handling
On failure the system returns an explicit error or a flagged partial result. It does not fabricate or silently estimate values.
| Condition | System behaviour | Outcome for user |
|---|
| Model output unusable | One retry on a more capable model | Clear error and request for a clearer image if the retry fails |
| AI provider rate or usage limit | Request stopped; no partial result stored | Retry or plan message |
| Non-business document | Rejected | Explanation of accepted document types |
| Duplicate document | Not reprocessed | Original record referenced or stored result returned |
| Missing quantity, unit or classification | No figure calculated for the affected line | Partial result with visible flags |
| No matching registry factor | No figure calculated | Line flagged as having no factor |
| Plausibility check failure | Calculation blocked | Line routed to human review |
| Unauthenticated or unauthorised request | Rejected before processing | Access error |
| Failed payment verification | Rejected before any plan change | No change to subscription |
| Advisory chat cannot load records | States records are unavailable; produces no figures | Offer to retry |
11. Known limitations
- Results reflect the documents supplied. Missing or incorrect source documents produce incomplete or inaccurate results.
- Document-based accounting is suited to screening and baselining. Installation-level regimes need measured facility data, which customers must supply.
- Optical extraction can misread poor-quality documents. Flagged lines require human confirmation before use in a disclosure.
- Spend-based Scope 3 figures are indicative and carry wide ranges.
- Range calculations use first-order error propagation and assume independent activity errors; they describe stated factor and input uncertainty, not unknown or unreported errors.
- A hash chain detects alteration after the fact. It does not prove that the original document was truthful.
- Factor coverage varies by country. Where no primary factor exists, no figure is produced.
12. Governance and assurance status
- Methodology and factor-registry changes are versioned and dated. Prior versions remain available for audit.
- Senseible does not currently hold a third-party security certification such as SOC 2 or ISO/IEC 27001, and its outputs have not been independently assured.
- Methodology documentation, the Data Processing Agreement, the sub-processor list and security questionnaires are available to prospective enterprise customers under NDA. Contact: build@senseible.earth.
Appendix A. Notation
| Symbol | Meaning |
|---|
| E | Emissions, kg CO₂e (kilograms of carbon-dioxide equivalent) |
| A, Aᵢ | Activity quantity (litres, kg, kWh, tonne-km), for line i |
| EF | Emission factor, kg CO₂e per unit of activity |
| GWP | 100-year Global Warming Potential of a gas, relative to CO₂ |
| CC, OF | Carbon content of a fuel; oxidation fraction |
| m, d | Mass moved (kg); distance (km). In equation (12), d and dₖ are days |
| S | Spend, in currency units |
| Aₚ, Ac, kᵤ | Quantity as printed; quantity in the factor's unit; unit multiplier |
| Mg, Gg | CO₂ emitted by power station g; electricity it supplied |
| kW, kvar, kVA, φ, mean(PF) | Real, reactive and apparent power; their phase angle; average power factor over a billing period |
| NCV, ρ | Net calorific value (energy per mass); density (mass per litre) |
| u, U, σ | Relative uncertainty of a line; of a total; absolute standard deviation |
| f | A factor shared by several lines |
| Q, pₖ, nₖ | Data-quality score; penalty for flag k; count of flag k |
| Fₚₐₛₛ | Share of lines in a batch that pass the score threshold |
| q, r, a, dₓ | Printed quantity, rate and amount; their number of decimal places |
| β₀, β₁, sᵣ, Ŷ | Trend intercept and slope; residual standard deviation; projected 12-month total |
| h, eᵢ, ‖ | Hash value; ledger entry i; concatenation (joined end to end) |
Appendix B. References
- [1] WRI and WBCSD. The Greenhouse Gas Protocol: A Corporate Accounting and Reporting Standard, Revised Edition (2004).
- [2] WRI and WBCSD. GHG Protocol Scope 2 Guidance (2015).
- [3] WRI and WBCSD. Corporate Value Chain (Scope 3) Accounting and Reporting Standard (2011), and Technical Guidance for Calculating Scope 3 Emissions (2013).
- [4] WRI and WBCSD. Guidance on Uncertainty Assessment in GHG Inventories and Calculating Statistical Parameter Uncertainty (2003).
- [5] IPCC. 2006 Guidelines for National Greenhouse Gas Inventories, Volume 1, Chapter 3 (Uncertainties); Volume 2, Chapter 1, Tables 1.2 to 1.4 (default net calorific values, carbon contents and CO₂ emission factors), and Chapter 2 (Stationary Combustion).
- [6] IPCC. Climate Change 2021: The Physical Science Basis, Working Group I contribution to the Sixth Assessment Report, Chapter 7, Table 7.15 (100-year Global Warming Potentials).
- [7] ISO 14064-1:2018. Greenhouse gases: Specification with guidance at the organization level for quantification and reporting of greenhouse gas emissions and removals.
- [8] JCGM 100:2008 (ISO/IEC Guide 98-3). Evaluation of measurement data: Guide to the expression of uncertainty in measurement.
- [9] NIST. FIPS PUB 180-4: Secure Hash Standard (2015).
- [10] IEEE Std 1459-2010. IEEE Standard Definitions for the Measurement of Electric Power Quantities Under Sinusoidal, Nonsinusoidal, Balanced, or Unbalanced Conditions.
Legal Disclaimer
This White Paper describes the methods and current capabilities of Senseible for information only. Nothing in it is an offer to sell, or the solicitation of an offer to buy, any security, financial instrument, product or service, and nothing in it is legal, financial, accounting, tax, regulatory or assurance advice.
Senseible publishes this White Paper so that customers, auditors, technical reviewers and the public can examine its approach and send feedback and comments. Any commercial relationship will be governed only by definitive documents, such as the Terms of Service, Privacy Policy, Data Processing Agreement and order forms. Those documents may differ from this White Paper, and where they conflict they prevail.
Emission figures produced with Senseible are calculated estimates based on the documents and data a customer supplies. They are self-declared by the customer. They are not certified, audited or independently verified unless a separate written verification statement says so, and Senseible does not guarantee that any regulator, lender, investor, buyer or other third party will accept them.
Nothing in this White Paper is a guarantee or promise of how Senseible's business, platform or methods will develop, or of any result, saving, outcome or value from using them. It outlines current practice and plans, which Senseible may change at its discretion. Their success depends on many factors outside Senseible's control, including changes in law, standards and published emission factors, the availability and quality of customer and third-party data, and the services of third-party providers.
Any statement about future events is based solely on Senseible's own analysis of the matters described in this White Paper. That analysis may prove to be incorrect. Equations and worked examples are illustrative, use round numbers that are not published emission factors, and are provided to explain method only.
Feedback, questions and security or compliance review requests: build@senseible.earth