ESG data is board-level data.
We protect it that way.
Enterprise identity, granular access, a complete audit trail and responsible AI, so your security, risk and audit teams can say yes.
Identity & sign-in
SAML single sign-on
Connect ESGware to your identity provider so people sign in with the account they already use.
Two-factor authentication
Authenticator-app (TOTP) 2FA with recovery codes, and the option to require it for everyone.
Session control
Idle timeouts, account lockout after repeated failures, and the ability to see and revoke active sessions.
Access control
Roles & custom roles
Permission-driven roles, including roles your administrators define for your organisation.
Access profiles
Grant access by module, feature and action: view, create, edit or delete.
Scope & network
Limit teams to the ESG themes relevant to them, and restrict sign-in to approved IP ranges.
Audit & accountability
Answer audit trail
Every change to a disclosure answer is recorded: who, what and when.
Security audit log
Sign-ins, permission changes and administrative actions are logged with reference codes.
Approvals & locking
Approval stages, published-report locking, retention policies and legal hold.
Your data, your control
Full data export
Export your organisation's data at any time. Your data is never held hostage.
Organisation isolation
Every organisation's data is scoped and separated at the application level.
Secrets protected
Integration secrets such as webhook signing keys are encrypted at rest.
Responsible AI
Structured inputs only
Meridian AI drafts from the structured answers you have saved, never from your raw uploaded files.
Human approval
AI output is always a draft. Nothing is published until a person reviews and approves it.
Explainable scores
The Meridian ESG score shows how every pillar and theme score is calculated.
Safe integration
Signed webhooks
Outbound events are signed with HMAC so your systems can verify they came from ESGware.
Scoped API keys
Read-only reporting API access with keys your administrators can create and revoke.
Separated environments
Test environments are prevented from contacting real customers or endpoints.
Need more detail for procurement?
Our team can walk your IT, security and privacy teams through architecture, access control, data handling and our responsible-AI approach as part of your evaluation.
