Where your data lives, and who can access it.
We run it for you — in our infrastructure, or yours if policy requires it.
The default is a managed instance we run on infrastructure we operate — nothing to deploy or maintain on your side. If policy requires it inside your own infrastructure instead, we deploy and operate it there ourselves — you still don’t have to run anything yourself.
The default — we run it for you
A container we operate on infrastructure we manage. Nothing to deploy or maintain on your side — just a live instance kept patched, monitored, and backed up.
- Live within days of your first site being mapped
- TLS in transit, encrypted storage at rest
- Region and operating responsibilities agreed during quotation
We deploy it there ourselves — if policy requires it
If policy requires it inside your own security boundary, we deploy and operate it there for you: the same container, with TLS handled by an included reverse proxy that obtains and renews its own certificate automatically. You still don’t manage the deployment.
- Your data centre, or your private cloud tenancy
- No data ever leaves your network boundary
- We handle setup and operation — nothing for your team to run or maintain
Neither option changes what the application does with your data — see access control and migration for that.
Not everyone who can see a number should be able to change one.
Role-based access is available by request and scoped to the way your organisation works. Separate the people who administer the platform from those who analyse figures or review them for assurance.
Manages sites, users and roles, conversion factors, and reporting configuration. Typically one or two people per organisation.
Full read access across every module, plus export. Cannot change factors, reporting configuration, or user permissions.
Read-only, optionally scoped to specific sites. Built for the reviewer who needs to verify a figure, not administer the system.
Role-based access can be scoped into every plan, including Site. Even a single facility benefits from separating the person who manages reporting configuration from the manager who needs the monthly number. Tell us which responsibilities must stay separate and we will include them in the quotation.
The parts of the design that exist so nothing else has to change.
Scoped credentials, nothing broader
Every credential the application holds is scoped to exactly what it needs to do its job. Access is narrowed by design, not left open on the assumption it will stay that way.
No credentials in client code
Sessions are signed and expire; nothing capable of reaching your data ever ships to a browser. A compromised laptop is not a compromised database.
TLS everywhere
Every deployment sits behind TLS, cloud or on-premise. Data in transit is encrypted the same way regardless of which residency option you chose.
Fails closed
If access controls are misconfigured or credentials are missing, the application serves nothing rather than serving data to whoever asks. Nothing is exposed by default.
Credential rotation revokes active sessions
Rotating access credentials invalidates outstanding sessions so removed or compromised access does not remain active on another device.
Your data, exportable, always
Full-precision CSV export exists for a reason beyond convenience: nothing you put into Envera is held hostage inside it.
AI Engineer is optional, and off until you ask for it.
Nothing on this page changes unless you switch AI Engineer on. When it is on, the questions your team types and the figures needed to answer them are sent to Google’s Gemini API to write the answer. Envera uses Google’s paid service, under which Google does not use that content to train its models. Your database is never opened to Google: AI Engineer reads your data inside your deployment, through the same read-only access as the dashboard, and sends only what a question needs. Questions that need public facts, such as a tariff or an emission factor, are looked up in published sources and the answer lists them. Without AI Engineer, nothing leaves your deployment.