EU-hosted
Hosted in Nuremberg, Germany, on EU infrastructure. Your customs documents and declarations are stored there.
Trust & security
Built to be
audited.
A CBAM declaration is an auditable filing — so the tool that produces it has to be auditable too. Your data is hosted in the EU, a person approves every line, and every change is on an append-only trail you can reconstruct.
- 09:24:01 operator line 03 · net mass corrected 24.18 t
- 09:24:01 system recompute · € 112,660 · 28.6 tCO₂e
- 09:31:47 operator line 07 · proven actual attached
- 10:02:10 approver declaration approved · v23 staged
Reconstructable, line by line
The posture
Four things that don’t move.
Not a badge wall — four guarantees that shape how the product is built. Each one is the answer to a question your auditor, your DPO, or your buyer’s procurement will ask.
Human-approved OCR
OCR reads your customs PDFs, but nothing is final until a person approves it. Every line carries a Ready / Check / Fail verdict you sign off before anything is filed.
Reference-checked calculations
Calculations are checked against a set of reference values hand-verified against published figures before they go live. The numbers are tested, not asserted.
Everything on an audit trail
Every edit, recompute and approval is recorded — who, what, when. The declaration you file can be reconstructed from an append-only log, line by line.
Data residency
Hosted in the EU.
From hosting to fonts, the data path is built to keep your customs documents inside the EU — the posture your buyers and their auditors expect by default. The items below name the places where our legal texts say data can leave it.
- Hosting
- EU infrastructure, in Nuremberg, Germany. Your documents and declarations are stored there.
- Document OCR
- Read by an EU-based provider with zero data retention on the endpoints we use — pages are processed inline, not stored. Our OCR provider receives the documents we send to its EU regional endpoint. According to the provider’s documentation, that endpoint uses data centres in EU and EFTA countries; the provider has not yet confirmed in writing that our OCR calls fall within that regional processing commitment. The provider states that regional processing is subject to limited, safeguarded transfers to its sub-processors outside that region, as described in its Trust Center, and that, depending on the feature used, data can be temporarily transferred outside the European Union, with safeguards such as the European Commission’s Standard Contractual Clauses. Zero data retention is enabled for our organisation; it governs whether the provider keeps the documents after processing, not where they are processed.
- Analytics
- Privacy-first, EU-hosted, with session replay off. No analytics event is recorded before you consent.
- Fonts & assets
- Self-hosted — no third-party font or CDN call that would leak a request outside the EU.
- Payment
- Buying a licence is a separate exception. Payment is handled by Dodo Payments, which sells the licence to you as merchant of record. Its data-processing agreement — we accepted it with Dodo Payments Inc. — states that it transfers personal data outside the EEA and the UK, and that the European Commission’s Standard Contractual Clauses are incorporated into that agreement to cover those transfers.
Nothing auto-files
The machine reads. A person decides.
OCR does the typing, not the judging. Every line lands on the ledger wearing a verdict, and the declaration only moves when you approve it — the approval rule that runs through the whole product.
Ready
Read cleanly and reconciled. Nothing for you to resolve — but it still waits for your approval before it counts.
Check
Something needs a human eye — a low-confidence read, a value to confirm. Surfaced honestly, never silently guessed.
Fail
Can’t be filed as-is — a missing mass, an unreadable field. Held back loudly, so a broken line never slips into a filing.
Trust by subtraction
What we never do.
- No session replay, and no selling or sharing your data.
- No auto-filing — a declaration is never lodged without your approval.
- No drift into company-wide emissions reporting, offsets, or advice.
Read on
See it in the product.
Human-approved OCR
See the review surface where nothing counts until a person signs it off — the forensic ledger, Ready / Check / Fail, line by line.
See the ledger →About Sustys
Why a specialist instrument for one regulation, held to an audit standard — the thesis, and who’s behind it.
Read the thesis →CBAM-as-a-Service
Auditable by design. See for yourself.
Join the closed pilot to read your first declaration on the forensic ledger, or talk to us about your security and procurement requirements.