A settlement layer that can prove every number it moves
Businesses want to fund environmental certificates without buying a whole one, and want to show later exactly what they funded. We built the platform that holds both halves: double-entry accounting under every movement of value, and a calculation record that can be re-derived step by step.
- IndustryEnvironmental markets and corporate reporting
- EngagementFull platform design and build
- StatusIn production on cloud infrastructure we operate
You buy an amount, not a certificate
An operator buys environmental certificates in bulk, pools them, and sells fractions of them over an API. A business buys an amount, so many buyers co-fund the same certificate until it is fully funded. Then it is retired once, and every contributing business receives its own proof of the share it funded.
Beside that sits the reporting half: footprint models that calculate the way each sector's published methodology says they should, for hospitality and for wine production. A business can size its own emissions before it decides what to fund.
Shared ownership, and numbers nobody can prove
A market where many buyers fund one certificate breaks every assumption a spreadsheet makes, and the figures underneath have to survive an audit.
One certificate, many owners, one retirement
A certificate can only be retired once, but the money that funded it came from a queue of buyers who each paid at a different moment for a different share. Getting that wrong is not a reporting error, it is somebody else's money.
A footprint figure nobody can re-derive
A number in a report is worth whatever the ability to reconstruct it is worth. With no record of which inputs, which steps and which edition of which factor produced it, a restated figure cannot be explained a year later.
The inputs arrive as documents
The evidence behind a footprint arrives as invoices and as published source papers. Somebody has to turn those documents into data. Reading them by hand is slow, and reading them automatically is exactly where a wrong number enters and stays.
Accounting discipline under a market, and a record under every number
Each capability exists because somebody has to be able to check what the system did with their money or their figures.
Double entry under every movement of value
Value never appears from nowhere and never vanishes. It moves between named account classes: customer, pool, certificate, registry, revenue and retired. The ledger itself enforces that, so an application bug cannot leave an account out of balance.
- Named account classes, and every transfer is a debit and a credit
- A background worker reconciles the ledger against the operational records and alerts the moment the two disagree
- Keys against double processing on every write, so a retried request cannot charge twice or allocate twice
Strict first in, first filled, under concurrent load
A purchase fills the oldest unfilled certificates first, inside a single transaction. The order is enforced by the order in which the database records are locked, not by hoping two purchases never arrive together.
- Concurrent purchases lock the queue in the same order, which rules out both queue jumping and deadlock
- One purchase can fund a fraction of a certificate, and several certificates at once
- A scan that reaches its limit raises an alarm, so a short allocation cannot pass unnoticed
Calculations that can be re-derived
Every footprint calculation writes an immutable record of its inputs, each step it took, and the edition of every emission factor it applied. The same inputs produce the same record, which is what makes a restated figure explainable.
- An immutable record per calculation: inputs, steps, and the factor edition in force
- Every result carries an uncertainty range alongside the figure it reports
- Sector models follow the published methodology that sector actually reports against
Documents become graded data, and a person still signs it off
Uploaded invoices are resolved into individual lines that feed the footprint calculation with their provenance attached, and each line carries its own data quality grade. Emission factors are never edited in place: a new version is appended with its own validity dates.
- Each resolved invoice line carries a data quality grade, and a calculation reports the worst grade behind it
- Factors are append only and versioned, so a restated figure traces to the edition in force at the time
- Machine readable official sources can apply on their own; anything read out of a document waits for a second person to approve it
What the build actually enforces
No figures here. This is a platform we built and exercised in depth, not one whose customer results we are quoting.
Traceable
Every figure
A published number can be followed back to its inputs, the steps that produced it, and the factor edition that was in force, without anyone re-deriving it by hand.
In order
Every allocation
Contributions fill the oldest certificate first even when purchases land at the same instant, and the ledger is checked against the operational records continuously.
Built and tested
Where it stands
The platform is built, exercised across its services and running in production on infrastructure we operate. The controls this page describes are the ones that run every day.
Does your product have to prove its own numbers?
If money and measurement meet inside your system, we build the ledger underneath it and the record that lets somebody check it.
Discuss your project