DATA RETENTION POLICY
statutory archival & destruction schedule
Statutory schedule and cryptographic standards for storage lifecycles, tamper-evident audit archival, and secure data disposal across enterprise carbon accounting estates.
1. Statutory Objectives & Legal Mandates
ZeroCarbon manages, archives, and securely disposes of enterprise sustainability records in accordance with global statutory obligations. Corporate carbon accounting records serve as statutory financial and ESG disclosures subject to regulatory audit by Big-4 assurance partners, SEBI, the European Commission, and the Ministry of Corporate Affairs (MCA).
This policy coordinates compliance across:
- Section 128 of the Companies Act, 2013 (India): Requiring books of account and vouchers to be preserved in good order for a minimum of 8 financial years.
- Section 44AA of the Income Tax Act, 1961: Mandatory maintenance of financial books and utility bills for 7 to 8 assessment years.
- SEBI BRSR Core Guidelines: Mandatory 8-year preservation of reasonable assurance verification documents.
- European Union CSRD / ESRS E1: Prescribed 10-year archival for corporate sustainability reports.
2. Corporate Data Classification Matrix
Information processed by ZeroCarbon is classified into four operational tiers:
Tier A: Primary Evidence Vouchers
Raw utility invoices, meter exports, fuel receipts, logistics manifests, and third-party lab assay certificates uploaded by the client.
Tier B: Calculated Emissions Ledgers
Deterministic Scope 1, 2, and 3 calculations, mapped emission factor coefficients, and unit conversion traces.
Tier C: Report and Audit Hashes
SHA-256 hashes of source files and generated reports, timestamps, and the hash-chained audit log, kept in our own ledger.
Tier D: Ephemeral Session & System Logs
API access logs, HTTP request telemetry, worker queue jobs, and client debug traces.
3. Statutory Retention Schedules
| Record Category | Retention Duration | Trigger Event | Statutory Basis |
|---|---|---|---|
| Emissions Invoices & Utility Bills | 8 Financial Years | End of relevant Financial Year | Companies Act, 2013 (Sec 128) |
| BRSR Core Assurance Packages | 8 Financial Years | Date of statutory filing | SEBI Listing Regulations (LODR) |
| CSRD / European ESRS Archives | 10 Calendar Years | Date of CSRD declaration | EU Directive 2022/2464 |
| Cryptographic SHA-256 Ledger Seals | Indefinite (Permanent) | Chain commitment | Verifiable provenance standard |
| API Access & Security Logs | Life of the account (at least 180 days) | Account deletion | CERT-In Direction No. 20(3)/2022 (180-day minimum); tamper-evident audit chain |
4. Report Anchoring
When ZeroCarbon generates a report, it keeps a fixed record of what was reported:
- Each report is anchored by a SHA-256 digest of its contents, which anyone holding the file can recompute.
- The anchored record cannot be edited through the application; a later correction to the underlying data produces a new report, not a changed old one.
- Uploaded source documents stay in private storage, linked to the records they support.
- Security-relevant actions are written to a hash-chained audit log.
5. Deletion
Upon expiration of the mandatory retention window or upon formal, verified customer request following contract termination (where statutory retention permits):
- A person's data is erased from Data control after a typed confirmation, in a single database transaction; a full data export is available there too.
- A whole company account is deleted by ZeroCarbon on a verified request from its owner.
- Copies held in our providers' backups expire on those providers' backup schedules.
- A company can turn on automatic deletion in Data control. Each day, source files whose retention period has ended are deleted with the text read from them. Files behind a filed report are kept while it stays filed, and the calculated records and each file's SHA-256 hash are kept. Otherwise retention periods are applied on request.
6. Customer Data Export & Portability
Customer may at any time export complete emissions ledgers, raw source attachments, and verification audit packages via our automated Data Export API or the dashboard in industry-standard JSON, CSV, and XBRL formats. ZeroCarbon does not engage in proprietary data locking.
7. Annual Compliance Audit & Review
ZeroCarbon Tech
This policy is reviewed annually in Q3 to incorporate updates from SEBI, MCA, and global climate reporting bodies.
Compliance Inquiries: compliance@zerocarbon.org.in