Data

The architecture

Sources in, evidence out. Every record carries a date and a source before it moves to the next stage.

The sources

Twenty independent sources, grouped by what they are. Sources are not blended: each answers one question, and the question determines where its output can appear.

Sources being added

The sources below are fetched on their own schedules and matched through the same identifier ladder and parent walk as everything above, but nothing they produce reaches a report, a band or an exclusion yet. Each is held in staging until a hand-checked sample of 100 matched records resolves to the right listed company at 95% precision or better. Most of these regulators act against a national bank or an operating subsidiary rather than the listed parent, and a wrong attribution against a named holding is the most damaging error a report can make.

Considered and not used

The GDPR route, stated honestly

Eight data-protection authorities are approached. They are not equivalent, and a source count that presented them as eight interchangeable feeds would be wrong:

Climate TRACE

Climate TRACE derives emissions independently, from satellite and sensor observation of the facilities themselves. Nobody self-reports to it — which is what distinguishes it from the figures an issuer publishes in its own accounts, and why the two can never be merged into one number.

Climate TRACE names the facility operator; the issuer graph names the listed parent. The two are reconciled through the same parent walk the enforcement records go through, so an observed figure is attributed to the company an investor actually holds rather than to whichever entity happens to run the site.

How the agents collect

Collection runs continuously and per source, because registers publish on their own schedules and none of them announce it.

1. Fetch. Each register is checked on its own schedule and the raw response is kept, along with the date it was retrieved. The stored artefact is what the report later links to.
2. Parse. A docket becomes fields: regulator, case reference, stage, decision date, penalty where one is stated, and the respondents named in it. Where a term or an end date is quoted — a consent decree, a monitorship — it is parsed from the source’s own text, narrowly, and anything ambiguous stays unknown.
3. Deduplicate. The same matter reaches us more than once, from more than one source. It is collapsed to one case, and a case naming ten defendants stays one case.
4. Normalise. Stage sets the severity band, source sets the position inside it, and the regulator’s remit sets the pillar.
5. Resolve. The parties named in the record become companies, or they go to the precision queue.

Identifier mapping

Resolution is deterministic at every step. A determination names a respondent — often a local operating entity, in the register’s own spelling, with no identifier attached. Turning that into a company a portfolio holds is a fixed sequence of checks, tried in order:

Behind the ladder sits a reconciled record of names, tickers, ISINs and LEIs, with duplicates collapsed, and a precision queue holding everything it cannot settle deterministically.

Parent and subsidiary

Regulators act against the entity in front of them, which is usually not the listed company. A fine against a national operating subsidiary is invisible to any dataset that stops at the named respondent — and that invisibility is exactly what makes a holding look clean.

So resolution does not stop at the entity. Once the respondent is identified, ownership is walked upward to the listed parent, and the determination is attributed to the company an investor can actually hold. Every hop is recorded, so the chain from docket to holding can be read back: this determination, against this subsidiary, owned by this parent, on this date.

Attribution is point-in-time throughout. Ownership as at the determination date is what governs, not ownership today, and where holdings are involved presence is recorded at stated observation dates with no continuity claimed between them.

What comes out

A run produces three dated outputs — the companies scored, the findings behind them, and the exclusions — each stamped with the register revision and scoring version that produced it. The six reports are views onto those artefacts rather than separate pipelines, which is why the answers cannot contradict each other.

What is deliberately not collected

No modelled or inferred figure is ever scored. Nothing estimated stands in where a company has not reported, no sentiment or controversy score is derived from media, no self-reported questionnaire is accepted from the assessed company, and no third-party ESG dataset is overlaid on top — the pipeline resolves, normalises and validates its own inputs rather than inheriting someone else’s conclusions.

Where a commitment depends on revenue by activity — tobacco, thermal coal, oil and gas — it is reported as untested rather than assumed passed. Where a company sits outside US, UK and EU jurisdiction, no adverse finding can arise here, so the absence of a finding says nothing about it.

Coverage is reported as its own figure beside every result, kept separate from it. A low adverse figure where coverage is thin can mean the record is hard to see rather than clean.