Breathe ESG Security and Trust: How We Protect Enterprise ESG Data
Breathe ESG is ISO 27001 and SOC 2 certified and GDPR compliant. More than 40 enterprises, including Ambuja Cement, CEAT, Swiggy, Paytm, Embassy Group, Rubrik, Solmax, KSB, Star Cement, Emami, Smartworks and Navneet, trust it with the data behind their ESG disclosures.
Your ESG data includes energy bills, supplier records, workforce numbers and board-level targets. It ends up in front of auditors, regulators and investors. The platform that holds it has to clear the same security review as your ERP. This page sets out how Breathe ESG does that.
Breathe ESG security at a glance
| Breathe ESG | |
|---|---|
| Certifications | ISO 27001, SOC 2, GDPR |
| Encryption | TLS in transit, AES-256 at rest |
| Hosting | AWS, multiple availability zones, India by default |
| Deployment | Cloud SaaS or on-premise |
| Access | MFA or SSO, role-based permissions, least privilege, periodic access reviews |
| Audit | Logged access and a full change log on every data point |
| Privacy | DPA, EU SCCs, UK Addendum, Swiss terms, named DPO, published sub-processors |
| AI | Customer data never used to train shared models; human approval before publishing |
| Integrations | ERP systems, IoT meters, APIs |
Certifications and standards
- ISO 27001 certified information security management.
- SOC 2, with reports available to customers during procurement.
- GDPR compliant, with ISO 27701 privacy commitments in our data processing terms.
Where your data lives
Breathe ESG runs on Amazon Web Services across multiple availability zones, so a single outage does not take you offline. Production data is hosted in India by default. For regulated industries and strict IT policies, Breathe ESG also deploys on-premise.
Encryption
All data is encrypted in transit with HTTPS (TLS) and at rest with AES-256.
Who can see what
- Users sign in with multi-factor authentication or single sign-on.
- Roles and permissions decide who can enter, review, approve and publish data, by facility, business unit or subsidiary.
- Access follows least privilege and is reviewed on a schedule.
- Every access is logged.
An audit trail behind every number
Auditors want to know where a number came from. Breathe ESG logs who entered or changed each data point, when, and the evidence attached. When your assurance provider asks about a figure, you trace it in a few clicks instead of digging through spreadsheets. That is why Breathe ESG is built for BRSR Core, CSRD and ISSB reporting that gets assured year after year.
Privacy and GDPR
- A standard Data Processing Agreement with every contract.
- EU Standard Contractual Clauses, the UK Addendum and Swiss terms for cross-border transfers.
- A named Data Protection Officer.
- A published list of sub-processors.
AI that stays inside your workspace
INARA, the Breathe ESG AI engine, cleans, maps and checks your ESG data. Your data is never used to train shared models, and nothing INARA suggests is published until a person on your team approves it.
Built for multi-site enterprises
Breathe ESG integrates with enterprise ERP systems and IoT meters to roll up data across business units, subsidiaries and facilities worldwide. One governed dataset then feeds every framework you report to, from BRSR and GRI to CSRD, ISSB, CDP and CBAM.
Trusted by enterprises who get audited
Ambuja Cement, CEAT, Swiggy, Paytm, Embassy Group, Rubrik, Solmax, KSB, Star Cement, Emami, Smartworks and Navneet run their ESG reporting on Breathe ESG, across cement, tyres, manufacturing, real estate and consumer tech.
Security FAQs
Is Breathe ESG ISO 27001 certified?
Yes. Breathe ESG is ISO 27001 certified, and our data processing terms also commit us to ISO 27701 for privacy.
Is Breathe ESG SOC 2 compliant?
Yes. Breathe ESG holds SOC 2. Reports are shared with customers during procurement.
How is my data encrypted?
Data is encrypted in transit with TLS and at rest with AES-256.
Where is my data hosted?
On AWS across multiple availability zones, with production hosted in India by default. On-premise deployment is available for strict IT environments.
Do you support SSO and role-based access?
Yes. Users sign in with multi-factor authentication or single sign-on, and roles and permissions control who can enter, review, approve and publish data.
Is my data used to train AI models?
No. Your data is never used to train shared AI models. INARA works on your data inside your workspace.
Will you sign our DPA and complete our security questionnaire?
Yes. Our DPA is published, and our team completes vendor security questionnaires as part of procurement.
Talk to our team
Need our SOC 2 report, ISO certificate or a completed security questionnaire for procurement? Contact us and we will send the security pack.