In short
- The trigger is an enterprise procurement or security review, not a regulator. That makes the deadline a deal date.
- Cloud, devices and travel are the footprint. Almost all of it is scope 3, and almost none of it is on a meter you own.
- A cloud provider dashboard is an input to your inventory, not a substitute for it.
For a software company the carbon question almost never arrives from a regulator. It arrives inside an enterprise procurement or vendor security review, next to the penetration test report and the data processing agreement, and it holds up the contract until somebody answers it. The emissions themselves are cloud compute, employee devices and travel, which is to say almost entirely scope 3 with barely a meter in sight. What the software has to produce is a repeatable annual inventory across all three scopes, plus exports that fit whatever questionnaire your largest prospect uses.
Which rule applies to a software company, and when?
Enterprise customer procurement. Large buyers ask their vendors for emissions data as part of security and procurement reviews, and for most SaaS companies that is the entire regulatory reality for now.
It behaves differently from a statutory obligation in three ways worth planning around.
The deadline is a deal date. Not a filing date. It lands with two weeks of notice and a deal in the pipeline behind it, which is the worst possible time to start collecting data.
The format is the buyer's. Every enterprise has its own vendor questionnaire, and they rarely agree on categories, boundaries or units.
It repeats per customer, not per year. One inventory has to serve five different forms, which is an export problem rather than a calculation problem.
If you are a smaller vendor being asked by a much larger customer, the VSME standard is worth knowing about: it lets a smaller supplier report once and point everybody at the same figures, and from financial years beginning on or after 1 January 2027 a "value chain cap" gives a supplier with an average of no more than 1,000 employees in a reporting company's chain the right to decline requests exceeding what the voluntary standard covers. Which requests fall outside that cap is covered in the ESG questions you can decline.
Where do IT and SaaS emissions actually sit?
In three places, none of which you burn anything to produce.
Cloud compute and hosting. Your production infrastructure, your data warehouse, your build pipeline and the model inference you may have added recently. This is purchased services in scope 3 and for most product companies it is the largest single line.
Devices. Laptops, monitors, phones and the servers you still own. The embodied emissions of a laptop dominate its lifetime energy use, which means the number is set at purchase, and a three year refresh cycle and a five year one produce visibly different footprints.
Travel and the rest of purchased services. Sales travel, offsites, the office, and every other SaaS tool you buy. A software company with fifty vendors in its own stack is buying somebody else's compute at one remove.
Two features make this sector distinctive. Scope 1 is often nearly zero, because you have no vehicles and no combustion, so a naive scope 1 and 2 footprint looks flattering and answers none of the questions a buyer is actually asking. And your absolute footprint is small while the scrutiny is high, so the work is proving the number rather than reducing it.
Can you just use your cloud provider's carbon dashboard?
Not on its own, no. It is an input, and a good one, but it is not an inventory.
Providers publish carbon figures for customer workloads, and they differ from each other in what they include, in whether they report on a market based or location based basis, in how they allocate shared infrastructure, and in how far behind the current month they run. Those differences matter when a buyer asks how you calculated the figure.
Four things to check before you paste the number into a questionnaire.
What it includes. Compute only, or storage, networking and managed services too.
Which basis it uses. Market based figures reflect the provider's energy purchasing. Location based figures reflect the grid where the region sits. They give different answers and a serious buyer will ask which one you used.
Whether embodied hardware is in there. The manufacture of the servers your workload runs on is a different question from the electricity it draws.
The lag and the granularity. If it reports quarterly with a two month delay, your annual close has to account for that.
The practical answer is to take the provider figure as your activity data for hosting, record which provider report and which basis it came from, and calculate the rest yourself. Where your cloud line is genuinely large, scope 3 work is what turns a dashboard export into something that survives a follow up question.
What is the enterprise questionnaire actually asking for?
Less than most founders assume, and in a stricter form than they expect.
| What they ask | What actually satisfies it |
|---|---|
| Your total emissions | Scopes 1, 2 and 3 for a stated year, with the boundary described |
| Scope 2 basis | A market based and a location based figure, or a clear statement of which you used |
| Scope 3 coverage | Which categories you assessed, and which you excluded and why |
| A reduction target | A target with a base year, or an honest statement that you have not set one |
| A published plan or policy | A document on your own website |
| Evidence | The method, the year and who signed it off |
The exclusions line is the one people get wrong. Saying you have assessed a category and found it immaterial is a strong answer. Leaving it blank looks like you did not look.
What should the software produce?
Four outputs, and only one of them is a chart.
A complete annual inventory across three scopes, on a boundary you can describe in a sentence, including a scope 1 of near zero stated explicitly rather than omitted.
Both scope 2 figures, market based and location based, because you will be asked for both eventually.
Exports into somebody else's template. Test this with a real customer questionnaire before you buy.
A method that holds still. The second year is what proves the first one meant something, and a boundary that shifts turns any comparison into noise.
What does Hedgehog do for IT and SaaS companies?
The platform guides you through GHG Protocol setup, inventory building, data upload and reporting with an AI assistant. It holds more than 20,000 spend-based and activity-based factors and lets you add organisation-specific or supplier-specific data, which is how a cloud provider export or a device supplier figure gets used directly instead of a proxy. It supports SBTi, B Corp and EcoVadis workflows, which is what enterprise buyers most often reference by name, and named legislation support covers CSRD, SECR and SB253.
A free account needs no sales call. Pro starts at EUR 1,200 per year, priced on user seats and business entities.
Two limits that matter to a technical buyer.
Integrations are limited today. A mid market customer on G2 in June 2026 asked for more integrations with other software. If your expectation is an API pulling cloud billing data in automatically, ask about your specific stack before you buy rather than assuming it.
Loading the data is the work. A small business customer said on G2 in August 2026 that once the data is loaded everything works perfectly, and getting it loaded is the challenging part. For a SaaS company that is a smaller job than for a manufacturer, but it is still the part that takes the calendar time.
One scope note. The platform produces organisational footprints. A per customer or per transaction product figure, meaning PCF or LCA work, is delivered as consultancy rather than as a platform feature.
What should you do first?
Export the last full year from your cloud provider and note which basis it uses. Then pull your device purchase records and your travel bookings for the same period. Those three files are most of a software company's footprint and none of them require anybody to start collecting something new.
Then write down the boundary in one paragraph: which entities, which year, which categories assessed and which excluded. That paragraph answers more questionnaire fields than any dashboard will.
You can build the whole thing on a free account, or bring in carbon footprint consulting if a deal is already waiting on the answer.
Sources: GHG Protocol Corporate Standard, Scope 2 Guidance and Corporate Value Chain (Scope 3) Standard, Hedgehog platform, Hedgehog on G2, Hedgehog industry fact base. VSME and the value chain cap verified against Directive (EU) 2026/470 on 28 August 2026. Other facts verified 27 August 2026.
Facts on this page were last verified on 2026-09-17.
