EmitLedger administrator guide

Everyone else in the organisation has a narrower view; the user-facing help explains the screens they use. This guide deliberately repeats the administrator-only parts.

How to read a path. Settings → Members means: open Settings in the sidebar, then the Members tab. Governance → Periods means: open the Governance group in the sidebar, then Periods. Labels are written as they appear on screen. A month is one asset and one calendar month; a reporting year is the twelve months that start in the month set on Settings → General.

Who may do what is stated for each task. The four roles that matter to an administrator are:

Executive viewers and external verifiers are read-only and free of charge. Support access is not a member role; it exists only while a client administrator grants it.

1. Setting up the organisation

Who: client admin or methodology owner for everything in this section. Master-data changes are recorded in the audit log.

Set-up happens once per organisation and again whenever you add an asset. The order below is the order the product expects: company defaults, then the hierarchy, then assets, then packs.

1.1 Onboarding wizard

Setup → Onboarding wizard walks through the first set-up and saves after each step with Save and continue.

1. Company profile: default consolidation approach, default GWP set, the month the reporting year starts in, an optional base year, and the default gas reference conditions (temperature in °C, pressure in kPa). All of these can be changed later on Settings → General.
2. Countries & assets: add a country, then Add an asset from a template. Choose the Asset template, click Preview systems and sources, adjust the Count for each source type, untick Include for sources the asset does not have, click Update preview, then Create asset.
3. Source register: rename the generated sources to your site tags and set each Quality tier. Open full setup takes you to the asset page for anything else.
4. Packs: BASE is active for every organisation. Other packs are activated per asset on the asset’s Packs tab.
5. Finish: check the setup checklist, click Complete onboarding, then Download Excel templates to start loading data.

The Finish step shows “Setup: … of … done”, worked out from your own data: assets and sources, gas compositions where a source needs one, grid regions for assets that buy electricity, the gas-to-boe conversion and base year, the team, and the first activity data. Each item is Done or To do with an Open link. You can complete onboarding with items still to do.

The asset templates create systems, emission sources (with category, calculation method and quality tier) and their data streams in one step. The Excel templates are generated from that register, so the workbook always matches the configuration.

1.2 Countries, regions and assets

Setup → Hierarchy shows regions, countries (with their two-letter ISO code) and the assets in each country.

• Add region, Add country, Add asset and Edit are the actions. A country code must be a two-letter ISO code.
• An asset is placed under a country; an asset with no country appears as No country on the dashboards. Regions are optional groupings above countries.
• Click an asset name to open Asset setup.
• Deleting an organisation unit is confirmed and cannot be undone; it is refused while assets or other records still refer to it (409 IN_USE). An asset that still has data cannot be deleted either; close it with an end date instead. Deleting an empty asset frees its place against the plan.

1.3 Asset setup: systems, sources and data streams

Setup → Hierarchy, then the asset, opens Asset setup with two tabs, Details and Packs.

On Details:

• Asset details: asset code, name, asset type, country, operator, Operated by us, start and end dates, coordinates, Grid region and Industry segment.
• Grid region is the electricity grid below country level, named as the grid factor’s publisher names it (for example a US eGRID subregion, or an Australian NGER state or grid). Leave it empty to use the country’s grid factor.
• Industry segment makes segment-specific factors apply. Not set means they do not apply.
• Systems (Add system) group equipment, for example Power generation or Flare system.
• Source register lists every emission source: Tag, Name, System, Category, Sub-category, Method code, Method version, Quality tier, Scope, Fuel type, Composition label, Active from, Active to, and on some sources Biogenic carbon share (%) and Equipment type/Factor row. Add source adds equipment.
• Streams on a source show its Data streams: Name, Role (the method input), Quantity, Unit, Classification, Frequency, Meter tag and Maximum value. More than one stream can carry the same role; their values are added.
• A gas meter that reports actual volumes at line conditions uses the unit Am3. Its stream then asks for line conditions: absolute pressure in kPa, temperature in °C and the compressibility factor Z. The result detail shows the conditions used.

Two details decide whether the numbers are right:

• Biogenic carbon share on fuel combustion sources is the share of the fuel’s carbon that comes from biomass, as stated by your supplier or fuel analysis (7 for B7 biodiesel, 100 for pure biomethane). The CO2 from that share is reported separately, outside the scopes; methane from it counts in Scope 1 as non-fossil methane. Leave it empty for fossil fuel.
• Units are stored as entered. The calculation engine converts them and carries the reference conditions; never convert by hand before entering data.

1.4 Equity shares

Asset setup → Details → Equity share periods is only needed for equity-share consolidation.

• Add period: Equity share (%) from 0 to 100 and Valid from / Valid to (empty means open-ended). Periods must not overlap.
• Operational-control reporting does not need equity periods; the share is then ignored.
• Once a month is locked, a change that would alter that month’s share is refused until a restatement reopens the month. Closing a share after the last locked month, or adding a later one, is allowed.

1.5 Packs on an asset

Asset setup → Packs:

• Activated packs with Active from and Active to, Activate pack, Suggested packs for the asset’s country, and Open compliance.
• Country presets only suggest packs; you decide which to activate.
• BASE (GHG Protocol, ISO 14064-1 and IPIECA structural checks) is active for every organisation. The regulatory and framework packs are listed on Settings → Plan & usage for your plan.
• All packs in the library are published; a pack marked Draft would still be awaiting subject-matter review. Pack results are indicative checks, not a regulatory opinion.

1.6 What setup changes

• New assets and sources change what the Excel templates contain and what completeness counts as expected data.
• A new pack changes the rule checks on Compliance for the years inside its activation window.
• Assets count against your plan: an asset beyond the limit is refused with a plan message (see section 3).
• Every change is in the audit log.

2. Users, roles and seats

Who: client administrators only. Settings → Members is not shown to other roles, and the page says so if they reach it.

2.1 Roles

Data providers, reviewers and country managers can be limited to selected countries and assets. The limit is applied in the database query, so a limited member never sees another asset on any dashboard, list or report. The other roles always apply to the whole organisation.

Four-eyes control is a matter of role assignment. The software does not stop one client administrator from reviewing and approving the same month; give the steps to different people.

2.2 Invite a member

1. Under Invite a member, enter the Email and choose the Role. The hint under the role says what it may do.
2. For a data provider, reviewer or country manager, set the Access limits: Whole organisation, or Only selected countries and assets and tick them.
3. Optionally set Access ends on for temporary access, for example for a verifier.
4. Click Send invitation.

The invitation link is valid for 7 days. A person without an account receives an email to set a password, then sets up a one-time password at the first sign-in. If your company uses single sign-on for its email domain, the form says so and no password is created for those people.

Consequences: a pending invitation counts as a seat. The invitation does not give access to anything until it is accepted and the person has set up two-step verification.

2.3 Change or remove a member

• Edit changes the role, the access limits or the end date. A role change takes effect on the next request; the person does not need to sign in again.
• Remove takes the role away immediately. Past work stays in the audit log, and a removed person can no longer sign in to this organisation.
• The organisation must keep at least one active client administrator: the last one cannot be removed or given another role (the page explains this).
• Reset two-step removes a member’s authenticator and recovery codes and signs them out; at the next sign-in they set up a new authenticator. Confirm who is asking before you use it. It is not offered for your own account, for people who belong to another organisation as well, or for people who sign in through single sign-on (their identity provider manages it). Every reset is audited.

2.4 Pending invitations and seats

• Pending invitations lists invitations not yet accepted. Re-send issues a new link and the previous link stops working; Revoke withdraws it.
• The page shows users against the plan’s limit, including pending invitations. External verifiers and executive viewers are free; support access is not a seat.
• When the limit is reached, an invitation for a counted role is refused with a plan message; free roles can still be invited. Remove a member, cancel an invitation, or ask your account manager about the plan.

2.5 Single sign-on and user behaviour

Single sign-on (Microsoft 365 or Google Workspace) carries the status On roadmap on Settings → Plan & usage. You do not configure it in EmitLedger; your support contact links your company’s email domain to the organisation.

When it is linked:

• the sign-in page asks for the email address first, and people in your domain are sent to your company sign-in;
• a company account never gives access on its own: each person still needs an invitation from a client administrator, and no password email is sent for an address in the SSO domain;
• your company’s MFA applies instead of the EmitLedger one-time password;
• people outside your domain, such as external verifiers, keep signing in with a password and a one-time password;
• when someone leaves, disable the company account and also remove the membership on Settings → Members.

A domain can belong to one organisation only. Before a domain is linked, your support contact asks for written confirmation from your IT or an executive, sent from an address in that domain.

2.6 Support access

Settings → Support access is how the support team is allowed to look at your data. Without a grant they cannot see it.

1. Enter the Support person’s email (your support contact gives you the address of their support account; the page refuses an address that is not a support account).
2. Set the Duration (hours); the default is 72 hours and the maximum is 720.
3. Enter a Reason, for example the ticket number and what should be looked at.
4. Click Grant access.

While access is active, a banner “Support access is active…” appears on every page with a Manage link. Revoke ends it immediately; otherwise it ends at Expires. The list keeps past grants as Active, Expired or Revoked. Access is read-only, and every request the support team makes, including reads, is recorded in your audit log.

3. Plans, entitlements and modules

Who: every member can read Settings → Plan & usage; only your account manager can change the plan.

3.1 What the page shows

• The Plan name, the Assets and Users used against its limits, and Limit reached when a limit is used up.
• Features (modules) with a status label where one applies: Rolling out (built, in final testing) or On roadmap (planned for a later release).
• Regulatory packs included in the plan.

The current published limits are:

Your contract or a legacy plan can differ. The page is authoritative for your organisation; it also says “legacy plan without limits” when your contract predates the current limits.

3.2 What is counted

• Users are members with an active membership in a counted role, plus pending invitations for counted roles. External verifiers, executive viewers and support access are free on every plan.
• Assets are asset records; the limit is checked when an asset is created, including from a template. Deleting an empty asset frees a place.
• Packs are checked when a pack is newly activated on an asset. A plan change never forces you to delete pack history: packs already active stay active.

3.3 Modules and what needs them

3.4 When a limit is hit

A refusal is an entitlement problem, answered with HTTP 402 and the code ENTITLEMENT_REQUIRED. The message names the limit and what to do. The specific codes are:

402 is used deliberately, so a plan limit is never confused with a missing permission (403). No existing data is deleted when a limit is hit. If API access lapses, existing keys stay listed but every call is refused, and webhook deliveries stop; you can still revoke keys and disable or delete endpoints. If the custom-factor module lapses, existing factors stay readable and can be deleted, but they cannot be added or edited. Ask your account manager to change the plan.

4. Reporting periods and locking

Who: see the workflow below. The board and its actions are available to the roles named for each step.

4.1 The period board

Governance → Periods is a board of assets (rows) by months (columns) for one Reporting year. Each cell shows Open, Submitted, Reviewed, Approved or Locked. A dot marks a month where an action is available to you.

• Filter by Asset, or use Highlight status to pick out one status.
• Select a month to open its dialog: status, Last comment, the actions available to you and Evidence.
• A month must pass through the statuses in order; you cannot approve a submitted month directly.

4.2 The workflow and who can act

Only months that have ended can be submitted, reviewed, approved or locked: from the first day of the next month (UTC). Until then the board shows no dot and the dialog says from which day the actions are available. Reject remains available on a submitted or reviewed month; a reviewer or country manager can also reject a month that has been marked reviewed, within their access limits, but only an approver can move a month to Approved.

Take an action by selecting the month, adding a Comment (required to reject) and clicking the action. The confirmation says what the month is now.

4.3 Bulk action

Bulk action applies one action to every month of the assets shown, in the year shown, that allows it: Submit, Mark reviewed, Approve or Lock.

• The dialog says how many months qualify. A comment is optional and recorded on each month.
• Each month is checked on its own, with the same rules and rights as a single action. The result says how many moved and lists the rest with the reason.
• Reject is not offered in bulk, because each rejection needs its own reason.

4.4 Locking

A month can be locked only when all of these hold:

• the latest calculation run covers the month (LOCK_REQUIRES_CALC otherwise);
• that run succeeded (LOCK_CALC_NOT_SUCCEEDED);
• no activity data for the month changed after the run started (LOCK_CALC_STALE);
• the run has no error findings for that month (LOCK_CALC_HAS_ERRORS).

If data changed after the last run, wait for the recalculation or start one on Data input → Calculation runs. A month cannot be locked while a calculation for the asset is running; try again when it has finished.

What locking does:

• A locked month cannot be changed by import, form, activity grid or API. Writes are refused with E006 findings, and the request is answered with 409 PERIOD_LOCKED.
• Set-up a locked month depends on is protected: an equity-share change that would alter the month, or moving a source with results in the month to the other scope, is refused. Reopen the month first.
• A recalculation never rewrites a locked month. It skips it and reports W-PERIOD-LOCKED-SKIPPED.
• Changing data in a submitted, reviewed or approved month returns it to Open; imports raise warning W040 for this.

Before approving, check Dashboards → Data quality for completeness, anomalies, unverified factors and pending imports.

4.5 Restatements

Governance → Restatements reopens locked months so you can correct them. Only client administrators and methodology owners can request or approve one.

1. Request restatement: choose the asset and the month range, enter the Reason, click Submit request. Only locked months in the range are reopened, and only after approval.
2. An approver clicks Approve (comment optional) or Reject (comment required).
3. Correct the data and let the recalculation finish.
4. Submit, review, approve and lock the months again on Periods. The restatement becomes Completed.

A restatement records the Change: the difference between the relocked totals and the originally locked totals (Scope 1 plus location-based Scope 2). It flags a Base-year recalculation when the change to base-year emissions exceeds the threshold on Settings → General. Requests, approvals, reopened months and the change are audited, and evidence can be attached.

Two refusals you will meet: RESTATEMENT_OVERLAP when another open restatement covers part of the range, and NO_LOCKED_PERIODS when there is nothing locked to reopen.

5. Factor library and pins

5.1 Releases and pins

Setup → Library (Reference library) shows which release of the reference library is pinned for each reporting year. A release contains the emission factors, GWP sets and other reference data. Each year is calculated with one pinned release, so a new release never changes a past year silently.

Who: client administrators and methodology owners.

1. Under Change the release for a year, choose the Reporting year and a release.
2. Click Preview impact. A dry-run calculation compares current and candidate totals per asset and lists missing factors and findings. Nothing changes.
3. Click Confirm and recalculate to pin the release and queue the recalculation of that year only.

Release statuses are Draft, Published and Retired. A draft release can be pinned too; a retired one cannot. A year with locked months refuses a pin change (PERIODS_LOCKED) until a restatement reopens them.

5.2 Verification of library factors

Every library factor carries a reference to its source document and a licence, and is marked verified only when a person has checked it against that document, never by the software. The amber badge Includes unverified factors (x%) on the dashboards shows the share of the emissions in view that used at least one unverified factor. The audit export lists, for each result, whether each factor used is verified.

5.3 Your own emission factors

Setup → Your emission factors holds factors your organisation supplies: a fuel analysis, a supplier’s grid factor, a national factor the library lacks. Client administrators and methodology owners add and change them; everyone can read them. Creating and editing is included in the Pilot, Professional and Enterprise plans; on Essentials existing factors stay readable and can be deleted.

Precedence. Your factor beats the reference library for every source it matches: first one set on a source, then one set on an asset, then one for the whole organisation. Applies to attributes (category, sub-category, fuel type, equipment type, grid region, industry segment, flare tier, reporting year) narrow it; an empty field matches any value. A whole-organisation factor with no attributes applies to every source that needs that role and gas, so narrow it.

Country. Choosing a country limits the factor to that country’s assets, and a factor for one country outranks an otherwise equal one for every country. National grid factor fills the location-based grid factor role (CO2, t/MWh) for a country whose grid factor the library does not have.

Required fields. Reference and Licence are mandatory: name the document and who may use the value. The unit list shows the units the library uses for the chosen role, so the engine can convert the value.

Preview, recalculation, locked months. Preview runs a dry-run calculation for one reporting year and shows the CO2e difference in total and per asset; nothing is saved. Saving or deleting recalculates the months the factor covers. A change that would alter a locked month is refused and the preview lists those months; reopen them with a restatement, or start the factor after them.

Verification. A factor of your own is unverified until someone checks it against its reference. Mark verified records your name and the date; results then lose the unverified-factor warning for that factor. Changing any value clears the verification; editing only the note does not. Withdraw verification makes it count as unverified again. Every change is audited.

6. Data entry routes and imports

Who: client administrators and methodology owners everywhere; data providers for the assets in their access limits. Locked months refuse all of them.

6.1 Choosing a route

All routes validate before saving, keep earlier values as versions, write to the audit log and queue a recalculation of the affected months.

6.2 Excel import

1. Data input → Excel import: choose the Asset and the Reporting year.
2. Under 1. Download template, tick Pre-fill with values already committed if you want the current values, then Download template.
3. Fill the workbook. The Activity sheet has one row per monthly data stream, a Unit list, a Quality flag list (measured, calculated, estimated, gap_filled), one column per month and a Note. Other sheets hold compositions, production, events, energy and inventories. Locked months are grey and protected; do not add, delete or move rows, columns or sheets.
4. Under 2. Upload completed workbook, drop the file or choose it and click Upload and validate. The Import job page follows Upload, Validate, Commit.
5. Validation failed means nothing was saved. Filter the Findings by severity, sheet and code, read Cell, Message and Suggested fix, or click Download findings workbook to get the file with the problem cells highlighted.
6. Validation summary means it passed. Check Rows per sheet (New, Changed, Unchanged). Warnings do not block the commit, but each warning code must be acknowledged: tick the confirmation and click Acknowledge warnings.
7. Check Preview changes (current against new), then Commit import. The page shows Recalculation queued; the dashboards update when the run has finished.

A blank cell means “no data” and never overwrites a committed value; 0 means zero activity.

Rules worth knowing:

• Only one import can be open per asset and year (IMPORT_IN_PROGRESS); finish or Cancel import before uploading another.
• Files with macros, external links, embedded objects or suspicious compression are rejected.
• The uploaded workbook is kept as evidence of the import.
• Data input → Imports lists every job with file, asset, year, upload time, findings and status (Uploaded, Validating, Validated, Failed, Committed, Cancelled), filterable by status.

Common findings are in section 12.

6.3 Mapping wizard

Data input → Mapping wizard imports activity data from your own spreadsheet or CSV. Saving a mapping needs the mapping-wizard module (section 3).

1. Upload: choose the Asset and the file, click Read file. A Saved mapping chosen earlier can be applied directly with Import with this mapping.
2. Sheet & header: pick the Sheet, confirm the Header row, click Apply.
3. Layout: Months in columns or Dates in rows, and the column that holds row names or dates. For dates written as numbers, set the Date format. For CSV, set the Decimal mark and whether numbers use a thousands separator.
4. Map streams: for each row or column choose the Data stream and Unit, or Ignore. Unmapped rows are ignored.
5. Save & import: name the mapping, Save mapping, then Import this file.

The import then runs through the same validation and commit as an Excel import. A mapping that no longer fits the file fails with E050; an unreadable date with E051. New warnings must still be acknowledged.

6.4 Activity entry grid

Data input → Activity entry is for numbers you already have in a spreadsheet.

• Choose the Asset and the month range, click the first cell, paste from Excel (Ctrl+V, or ⌘V), review and Save.
• Decimal commas and spaces inside a number are accepted. An ambiguous value such as 1,234 is refused rather than guessed: enter it without a thousands separator.
• Arrow keys and Enter move between cells; Shift+click or Shift+arrow selects a block; Fill selection fills the selected months with one value. Save stores the values.
• A pasted value never overwrites silently: the old value stays in the history with you as the author. Pasting the same number again reports no change.
• Locked months are read-only and refused before anything is sent.
• After saving, each cell is reported as accepted, no change or rejected with a code (for example E006), and rejected cells stay in the grid to correct.

6.5 Operational records and evidence

Operational records holds Events, Production, Compositions, Instruments, Inventories & LDAR, LDAR programme and CO2 transfers. Each form applies the same rules: locked months are refused, changes queue a recalculation, and the record is audited.

Evidence is the Evidence button on compositions, events, instruments, inventory counts, leak findings, reporting periods, restatements, site-level measurements and reconciliation decisions. Imported workbooks are kept automatically.

• Upload a PDF, PNG, JPEG, XLSX, DOCX or CSV file; the dialog shows the maximum size.
• Files are type-checked from their content and scanned for malware. An infected file is refused; while the scanner is unavailable, uploads are refused rather than stored unscanned.
• Download opens a file; Remove takes it off the record and is audited. Evidence of a recorded decision cannot be removed. Detaching evidence from a locked month is refused until a restatement reopens it.

A reporting period accepts evidence once it has a record, that is after its first data change or workflow action.

6.6 API and webhooks

Settings → API keys and Settings → Webhooks are client-administrator pages; both need API access in the plan. Their setup, scopes and failure behaviour are in section 11.

Data sent with a key goes through the same checks as an import or manual entry: locked months are refused, approved months return to open, units must match the data stream, every change is audited and a recalculation is queued. Each item carries an external identifier from the sending system, so sending the same item again changes nothing. Up to 200 items are accepted per write request and each is answered as created, unchanged or rejected.

7. Calculations and audit

7.1 Calculation runs

Data input → Calculation runs lists every calculation: when it was queued, what started it (an import, a data change, a library pin, a restatement, a dry run or a person), the assets and months, the Status (Queued, Running, Succeeded, No change, Failed) and its Findings. Details shows the findings of one run with the asset and month they concern.

Recalculate calculates one asset or every asset over a month range with the current data, factors and library pins; Queue the calculation starts it. Use it when locking asks for a calculation, or after a factor or composition changed. Locked months keep their results. Client administrators, methodology owners and data providers (for their assets) can recalculate.

A failed calculation also appears under Waiting for you on the Overview.

7.2 Reproducibility

Every result stores the inputs it came from: activity ids, event ids, composition, the method code and version, the factor references and values, the library release, the engine version and an inputs hash. The audit export (section 8) gives one row per result with all of it, including whether each factor was verified. Real results are insert-only; a correction is a new version, and a locked month keeps its results until a restatement.

This is what makes a number reproducible months later, and it is why you should not edit data to “fix” a report: change the data through the normal route so the change is versioned, audited and recalculated.

7.3 Data quality

Dashboards → Data quality is the page to read before submitting or approving.

• Completeness: the share of expected stream-months that have a value. Only months whose data is due count; data is due on the Data due day of the month of the following month (day 15 if none is saved). A blank cell is missing data; enter 0 for zero activity.
• Data completeness by asset and month: a heatmap with one row per asset. A striped grey Not yet due cell is excluded from totals. Select a cell to open the period board for that asset and year. Show data table gives the same figures as a table.
• Unverified factors: the share of emissions in view calculated with at least one unverified factor.
• Aggregated uncertainty and Periods awaiting action.
• Emissions by quality tier, Import history (12 months) and Anomalies.

Completeness is also checked by the BASE pack on Compliance, which for the current year counts only the due months.

7.4 Uncertainty and Monte Carlo

When sources carry uncertainty data, the combined uncertainty is shown as Uncertainty ±…% · coverage …%: the combined uncertainty of the numbers in view and the share of those emissions that has uncertainty data. Coverage below 50% is shown as n/a, because it would describe too small a part of the total. The badge is absent when no result in view has uncertainty data.

The default combination is IPCC Approach 1 (error propagation, all errors independent). On Data quality, Monte Carlo uncertainty (IPCC Approach 2) offers Run Monte Carlo:

• it simulates the filtered total 10,000 times, with one random error per source (a meter’s bias repeats every month) and one per factor (shared by every result that uses it);
• it shows the 95% range in t CO2e and as ±%, with its coverage and the seed;
• the same filters and seed always give the same range, and the inventory report shows both approaches.

Use Approach 2 where many results share a meter or a factor: Approach 1 assumes independence and can understate the range.

7.5 Anomalies

Anomalies on Data quality lists months whose numbers look unusual, checked against Activity data, Emissions results or both:

• a month-on-month change above your Month-over-month change warning on Settings → General (50% unless changed), the same threshold Excel import warning W030 uses;
• a value far from the median of the previous 12 months (a modified z-score above 3.5, needing at least 6 of those months to have a value), the same check as import warning W035.

These are review aids, not errors, and they block nothing. Reviewers and administrators can Acknowledge, Dismiss or Reopen a listed month; the decision is shared by the organisation and hidden unless Show triaged is ticked. Watch asset sends that asset’s anomalies to your notification centre. The list shows the 200 most recent and largest deviations and says when there are more.

8. Reports and outputs

8.1 Requesting a report

Reporting & assurance → Reports generates files in the background.

1. Under Request a report, choose the Report type, From (month), To (month), Asset, GWP set, Consolidation and Scope 2 method.
2. Click Request report. The job appears under Report jobs as Queued, Running, Ready or Failed, and the list refreshes itself.
3. Click Download when it is Ready.

Who: client administrators, methodology owners, executive viewers and external verifiers for the whole organisation; data providers, reviewers and country managers within their access limits. Other roles see “Your role cannot export reports.”

8.2 Report types and the inventory PDF

The inventory PDF sections are:

• About this report
• 1. Organisational boundary
• 2. Reporting boundary, including exclusions
• 3. Quantification approach: methods, factors, GWP set, library releases
• 4. Results: Scope 1 by category and gas, captured and transferred CO2, Scope 2 by category, by asset and by country
• 5. Base year and recalculations
• 6. Uncertainty, including the Monte Carlo range
• 7. Data quality
• 8. Regulatory packs
• 9. Statement of limitations
• 10. Scope 3 Category 11 estimate, when the module is used
• Appendix A. Emission factors

There is no Word version of the report: the inventory report is PDF, with Excel tables and the audit export beside it. Every number in the PDF can be traced back to the audit export.

8.3 Scheduled reports

Reports → Scheduled reports emails a report automatically. Only client administrators and methodology owners see or manage schedules, because they send the organisation’s data outside the application.

1. Choose the Report: GHG inventory report (PDF), GHG tables (Excel) or Audit export (Excel).
2. Optionally choose an Asset; otherwise all assets.
3. Enter the Recipients and the Day of month (1 to 28).
4. Choose Every: Month, Quarter or Reporting year, then Add schedule.

The report covers the period that ended the month before, sent on the chosen day. Quarters and years follow your reporting year. A monthly schedule sends every month; a quarterly one only in the month after a quarter ends; an annual one only in the month after the reporting year ends.

The list shows the last delivery and the last error, with Pause and Resume. A schedule never shows more than its creator could see when it was set up. If the creator leaves the organisation or loses the role, the schedule is switched off at its next delivery and says why; create a new one. Recipients receive the file by email, so treat the recipient list as a data-sharing decision.

8.4 Filing outputs

With the Official filing outputs module (Professional and Enterprise), the Regulatory pack export offers:

• OGMP 2.0 Upstream Reporting Template 2025: the official workbook, filled for every asset with the OGMP 2.0 pack active in the period. Each OGMP source column gets the methane in tonnes and the reporting level from the quality tiers; an asset with any source below Level 3 is placed on the L1 and L2 Assets sheet in the five consolidated categories. Uncertainty, Level 4 methods, Level 5 and comments are for you to complete. Emissions are at 100% of the asset; the equity percentage is filled for you to apply.
• EU ETS annual emissions report — input sheet: one row per combustion or flaring source stream of an asset with the EU ETS pack active, with activity data, calorific value, emission factor, oxidation factor and biomass fraction, fossil and biogenic CO2, CH4 and N2O, and where each value goes in the official annual emissions report or your national reporting tool; plus a per-asset summary and the CO2 transferred out. It is not the official file: you enter the values there.

The OGMP 2.0 and EU ETS mappings are approved for use. The other export templates are drafts: the GRI, ISO 14064-1, SASB and IPIECA tables say so in their names, and the NZ ETS quantities sheet is a draft too. Review any output marked draft before you submit it. EPA e-GGRT XML is not available.

8.5 Branding and narrative

Settings → General holds the report branding:

• Report logo (client administrators only): PNG or JPEG, up to 2 MB, 16 to 4000 pixels per side. It is re-saved as a plain PNG and printed on the inventory report cover.
• Report text (client administrators and methodology owners): eight plain-text sections — organisation description, intended users, boundary statement, exclusions, methodology notes, base-year statement, verification statement and responsible person. Leave a blank line between paragraphs; empty sections are not printed. Each section is saved on its own and changes are audited.

8.6 How long files are kept

Generated report and export files are deleted 12 months after creation. The job stays in the list with the reason and Download is no longer offered: request the report again (the download then answers 410 REPORT_EXPIRED). Files attached as evidence and verification review trails are kept. Dry-run calculation previews are deleted after 30 days.

9. Verification, compliance and reconciliation

9.1 Verification workspace

Reporting & assurance → Verification is where you and an external verifier work on an engagement. EmitLedger records what both sides write and links it to the data; it does not decide severity, materiality, sample sizes or coverage — those are the verifier’s judgement.

Create an engagement:

1. Invite the verifier with the role External verifier and give the membership an end date.
2. Verification → New engagement: name, Verification body, Verification standard (free text, optional), Verified period (from and to month, at most 36 months), optional Severity labels (their own scale), and Assets in scope (or none for the whole organisation).
3. Open the engagement and use Assign verifiers on the Overview tab.

The status is Planning, Fieldwork, Findings or Closed; managers and assigned verifiers can change it. A closed engagement is read-only until a manager reopens it. An engagement with samples, RFIs or findings cannot be deleted.

The engagement has four tabs:

• Overview: body, standard, period, planned dates, sampling basis, severity labels, scope, assigned verifiers and the review-trail export.
• Sample: the verifier records a sample by Sampling unit (source in a month, source over the period, or asset in a month) and Method (seeded random with a sample size and optional seed, or largest contributors to a coverage percentage). Preview shows the selection; Record sample stores it with its seed, parameters and a fingerprint of the population. Recorded samples cannot be edited.
• RFIs: the verifier raises a request for information about the engagement or one object. A client administrator or methodology owner sets the Assignee (a data provider or country manager only for their own assets) and can change the Due date. The assignee attaches evidence, answers and clicks Send response; the verifier Accept response, Reopen with a comment or Close RFI. The thread cannot be edited or deleted. Overdue RFIs are marked Overdue.
• Findings: the verifier records Misstatement or Non-conformity with a severity label, a description, the asset and related RFIs. You write the Client response and can link the Restatement that corrects the data; the verifier closes it with Corrected, Not corrected or Withdrawn, or reopens it.

Review trail: on the Overview tab, Export Excel, Export CSV (ZIP) or Export JSON prepare the engagement record: scope, verifiers, samples and items, RFIs and threads, evidence file names and fingerprints, findings and linked audit events. Download it from Reports when ready. Every action in the workspace is also in the audit log.

A finding never changes data by itself: the correction goes through a restatement, which the finding can link to.

9.2 Compliance checks

Reporting & assurance → Compliance runs the rule checks of the packs active on one asset for one year.

1. Choose the Asset and Year.
2. Read Overall, then one card per pack with its activation window and counts (passed, failed, not applicable).
3. Each rule row shows Status, Rule (code and severity), Result and Evidence. Some packs show a dated notice (Notice, Under review or Superseded) with a link to the official source.

If the page says “No pack is active on this asset in this year”, choose a year inside the activation window or activate packs on the asset. Published pack versions never change; corrections and regulatory updates arrive as a new version.

Pack results are indicative checks on your data, not a regulatory opinion or legal advice. You remain responsible for your official submissions.

9.3 Measurement reconciliation

Reporting & assurance → Measurement reconciliation compares independent site-level (top-down) methane measurements with the source-level inventory of the same asset, and keeps a decision log. It provides the framework and arithmetic, not thresholds: which difference needs an investigation, or how many campaigns a year are expected, is your organisation’s own choice.

• Add measurement (client administrators, methodology owners and data providers for their assets): asset, optional campaign, measured from and to, technology, provider, measured CH4 value and unit (a rate or a mass), optional uncertainty at 95% confidence and detection threshold, coverage notes and evidence. A measurement used by a reconciliation cannot be deleted.
• Compare (client administrators, methodology owners, reviewers and country managers): choose the window and the Annualisation basis (rate × calendar hours, rate × operating hours, or the measured mass as is). The page shows bottom-up and top-down tonnes, each with its 95% range, the difference in tonnes and per cent, the ratio, whether the ranges overlap, and warnings such as below detection threshold or dates outside the window.
• A comparison is a snapshot: after either side changes, the row says Measurement changed: recompute; Recompute refreshes it. Decisions are disabled until it is current.
• Record decision: Accepted, Inventory adjusted, Measurement rejected or Under investigation, with a rationale and optional evidence. The latest decision sets the status. The decision log cannot be edited or deleted.
• A reconciliation never changes inventory results. An Inventory adjusted decision requires the restatement that made the correction.

10. Notifications

10.1 Email preferences

Settings → Notifications is personal: it chooses which emails you receive from this organisation. Everything is on until you turn it off.

Invitations, sign-in and security emails, and scheduled reports sent to your address are always delivered; they are not in the list. The choices are personal and never change what another member receives.

10.2 The notification centre

The bell in the top bar shows how many notifications you have not read. Click it to open the Notifications page, which lists what happened in this organisation that concerns you, newest first:

• a month submitted, sent back, approved or locked;
• a request for information raised or answered in a verification;
• your report ready, or your import failed;
• a restatement approved;
• overdue LDAR surveys or repairs;
• an anomaly in your data.

Click a line to go to the screen it is about; it is marked read. Mark read, Dismiss, Mark all read and Unread only manage the list. Notifications are kept for 180 days. The list is paged with Load more.

Who receives what follows the event: for example a submitted month notifies the approvers of that asset (respecting access limits), and an anomaly reaches administrators and methodology owners plus anyone who chose Watch asset.

10.3 What the bell does and does not send

• The bell is separate from your email choices. Turning an email off on Settings → Notifications does not remove the item from the bell, and there is no per-kind mute for the bell today.
• It carries only the events listed above. Data-due reminders and the result of a successful import are email only. Recalculation results, committed imports and reconciliation decisions are webhook events, not bell notifications.
• A notification holds a link and a state, not emissions values.

11. Security and data protection for administrators

11.1 Sign-in, roles and support access

• Every user signs in with a password and a one-time password from an authenticator app, set up at the first sign-in. Recovery codes are created on the account page (the My account link).
• Roles and access limits decide what each person sees; limits are applied in the database query.
• Platform staff cannot see your data unless a client administrator grants time-limited, read-only support access, and every request they make is in your audit log.

11.2 API keys

Settings → API keys (client administrators only) manages keys for the partner API. API access needs the plan module (section 3).

Scopes are fixed at creation:

Create: name the key for where it is used, choose an expiry (never, 30, 90 or 365 days, or a date), tick the scopes, Create key. The secret is shown once; copy it into the other system’s secret store. Only a fingerprint is stored, so a lost key cannot be recovered.

Authority: a key with a write scope acts with the authority of the client administrator who created it. The audit log shows the change as “API key (created by …)”. If that person leaves the organisation or loses the right to enter data, the key stops writing; reading is unaffected.

Rotate and revoke: Rotate gives the key a new secret and keeps its name, scopes, expiry and history; the old secret stops working immediately, so update the integration in the same change window. Revoke stops the key at once and cannot be undone. The list shows the first characters, scopes, creation and last use, expiry and status, so unused keys can be found and revoked. Creating, rotating and revoking are audited.

Treat a key like a password: never put it in a repository, a web address or a browser application. Give each integration only the scopes it needs; a data-pushing vendor usually needs no Read scope.

11.3 Webhooks

Settings → Webhooks (client administrators only) sends an HTTPS POST to another system when a chosen event happens.

1. Add an endpoint: an https URL (private and internal addresses are refused, redirects are not followed), an optional Description, and the Events.
2. The signing secret is shown once; store it in the receiver.
3. Send test queues a test ping; Deliveries shows status, HTTP code, attempts and last error.

The events are period.submitted, period.rejected, period.approved, period.locked, results.recalculated, import.committed, import.failed, reconciliation.decided, restatement.approved, report.ready, verification.rfi.raised, verification.rfi.answered and ldar.overdue.

Each request carries X-Webhook-Id, X-Webhook-Event, X-Webhook-Timestamp and X-Webhook-Signature. The signature is an HMAC-SHA256 of the timestamp and the raw body with the signing secret. Check it on the raw body, compare in constant time, and reject old timestamps. Delivery is at least once, so use X-Webhook-Id to ignore repeats.

Anything other than a 2xx answer is a failed attempt; failures are retried with growing delays, then the endpoint is disabled after repeated failures. Fix the receiver and click Enable; nothing is re-sent automatically. Rotate secret replaces the secret immediately, Disable pauses, Delete removes the endpoint and its log. Deliveries are kept for 30 days. Payloads carry identifiers and states only, never emissions values.

Webhooks need API access in the plan. Without it, existing endpoints remain listed but receive nothing; you can still disable or delete them.

11.4 Single sign-on

Single sign-on is on the roadmap and not configured by you; section 2.5 covers the user behaviour. From a security point of view: your identity provider becomes the gate, the domain is pinned to your company’s directory after written confirmation, and one domain belongs to one organisation. Remove the membership here when someone leaves, even after disabling their company account.

11.5 Audit log

Governance → Audit log records every change, import, calculation and export with before and after values. It can only be added to; no one can edit or delete an entry.

• Filter by Entity type, Action, Entity ID, Person, Actor name or email, From and To; Apply filters or Clear.
• Details on a row shows each Field with its Before and After value.
• Export CSV downloads the filtered entries.

Client administrators, methodology owners, reviewers, external verifiers and granted support can read it. Other roles see “Your role cannot view the audit log.” Requests made during support access are recorded here, including reads.

11.6 Retention

The audit log is part of your data and is deleted with it at offboarding (section 11.7). Evidence files and verification trails are retained because they are the record behind a reported number.

11.7 End of contract, export and deletion

Your data stays yours.

1. Before the end date, a client administrator can export everything at any time with the Full organisation export (ZIP) on Reports: one CSV per table, a manifest and the stored files. Take a final export before the subscription ends.
2. When the subscription ends, the organisation’s account is closed: members can no longer sign in to it, scheduled reports and reminder emails stop, and API keys stop working.
3. Retrieval period: for 30 days after the end of the subscription, an export is provided in the standard format on your written request to your support contact.
4. Deletion: after the retrieval period, the organisation’s data is deleted from the live service within 30 days: every record of the organisation, including its audit log, uploaded files, imports, reports and exports, its memberships, invitations, API keys, single sign-on set-up and the user accounts that belonged only to your organisation.
5. What is kept: people who also belong to another organisation keep their account there. Commercial records such as order forms and invoices are kept as the law requires and are not part of your organisation’s data in the application. Encrypted backups are not restored for this purpose and their copies are deleted as they rotate out under the schedule above.
6. Confirmation: deletion is confirmed in writing on your written request.

The periods in your own agreement prevail where they differ. Do not rely on the export at the last minute: a subscription that ends without a final export leaves you with only the retrieval route.

12. Checklists and troubleshooting

12.1 Day one

12.2 Every month

Monthly data is due on the Data due day of the month; reminder emails go to the people who enter data.

At year end, additionally: pin the library release for the new year, review targets and the base year, and confirm the audit export for the closed year is archived with your verification records.

12.3 Troubleshooting

Access and plans

Periods and restatements

Imports and data

The Findings table on the import job explains every code under What this means, and the full list is in the in-app help.

Calculations and factors

API, webhooks, files and reports

If something is not covered here, open the Help link next to the page title, or ask a client administrator to grant support access with the page address, what you did and the message you saw.