Effective date: 30 May 2026. Last revised: 3 November 2026. These are the current published terms for Carbon Trader® website and platform use.
Part 17 - Data Processing and Security Schedule
1. Security commitments
Carbon Trader will maintain commercially reasonable administrative, technical and physical safeguards appropriate to the nature of the information processed. These may include access control, authentication, audit logging, encryption, least-privilege administration, secure hosting, vulnerability management, backups and incident response procedures.
2. Access controls
Carbon Trader may use role-based access control, account roles, admin roles, authenticator apps, organisation permissions, audit logs and separation of duties for sensitive functions such as admin operations, KYC review, fee schedule publishing, settlement actions, payouts and refunds, and document access. The admin console requires an authenticator app. In an organisation, approval thresholds and approval limits can be changed only by an owner, nobody can change their own limit, and a price change on the organisation's live listing goes back to another approver, where the organisation has one, before buyers see it.
2A. Sign-in and account security
Carbon Trader runs its own sign-in. Users sign in with an email address and a password, with an optional authenticator app (time-based six-digit codes), or with a Carbon Tracker® account; an account created through Carbon Tracker is never matched to another account by email address. Passwords are stored only as salted, keyed hashes and cannot be read. Sign-in sessions are held in a secure, HttpOnly cookie and stored server-side only as a hash. Changing bank or NZETR account details, or turning off the authenticator app, asks for the password again (or, for an account that signs in with Carbon Tracker, a recent sign-in), and the account holder is emailed when it happens. The account holder is also emailed when their password changes, when sign-in is paused after repeated wrong passwords, and when an authenticator app is turned on or off.
3. Audit logs
Carbon Trader may log account access, admin actions, KYC actions, listing changes, settlement actions, payouts and refunds, fee calculations, document access, invoice and payment notifications from Xero, authentication events and security events.
4. Incident handling
Carbon Trader will triage security incidents, privacy breaches, suspected account compromise, suspicious settlement activity and other operational incidents. Carbon Trader may suspend affected accounts, end sign-in sessions, rotate keys, pause settlements, notify users, notify regulators and take remedial steps.
5. Backups and recovery
Carbon Trader may maintain backups of platform data and documents. Backup retention, recovery point objectives and recovery time objectives may vary by service and environment.
6. User responsibilities
Users must:
- keep credentials secret;
- protect the devices that hold their authenticator app;
- remove access for staff who leave;
- keep the email account linked to their account secure;
- monitor account activity;
- check transaction instructions;
- notify Carbon Trader promptly of suspected compromise.
7. Subprocessors and providers
Carbon Trader’s subprocessors and providers are:
- Cloudflare, Inc. - hosting of the website and application (Cloudflare Workers), the platform database (Cloudflare D1, whose primary copy is in Cloudflare’s Oceania region) and file storage for identity documents, statements and report exports (Cloudflare R2);
- Sinch Mailgun - platform email;
- Xero - invoices;
- Zoho Mail - the info@carbontrader.nz mailbox;
- Kudosity - sign-in codes by text message, for users who turn them on;
- Anthropic - the AI models behind the automated receptionist on the website chat and phone line;
- Retell AI, ElevenLabs and Twilio - the automated receptionist's phone line: call handling, voice, recording and transcripts;
- Google - Google Analytics and Google Tag Manager on the public pages.
Sign-in and identity verification are carried out by Carbon Trader itself. Carbon Trader may also use professional advisers, banks and compliance screening sources, and may update providers as the platform evolves.
8. Data return and deletion
On account closure, Carbon Trader may provide reasonable export options for available data. Carbon Trader may retain records required for AML/CFT, tax, accounting, financial services, legal, audit, dispute, registry, insurance and operational purposes.
Contact
For questions about this policy, contact Carbon Trader at info@carbontrader.nz.