Audit-ready Scope 3 Category 7 commute data — without employee surveillance

1 · Privacy architecture (co-determination safe)

• Zero continuous GPS. Distances are computed exclusively from fixed stop-table coordinates (stop-table deltas) — no live location, no movement profiles.
• Employer blindness & database-enforced k ≥ 5 floor. Org reporting discloses no group smaller than five employees — the threshold is enforced in the database layer, not by policy promise. Management never sees individual mobility data.
• Hardened bilateral contact disclosure. Phone numbers are released only after a mutually accepted ride request, via a security-definer RPC — never through open table reads.

2 · Versioned 2026 WTW emission factors

3 · Gross baseline vs. avoided emissions

The gross baseline (Scope 3 Cat. 7) is measured: verified passenger-km of confirmed rides instead of survey estimates with ~15% response rates. Avoided emissions, by contrast, are a counterfactual model with stated behavioural assumptions — always labelled as such and never part of the audited gross inventory.