Your residual stream may be another plant’s raw material. Finding out which one should not cost you your privacy.

Who finds out, and when

Before disclosure, a buyer sees a card. Your sector, a coarse region — North, East, South or West — a quantity band, the material category and intended application, up to three properties as bands, and whether the stream is declared hazardous. No company name, no site, no contact, no document, no exact value.

A reviewer checks the card before it is published. If too few other companies share its profile, the card is not published as it stands: a band is widened, or the reviewer records in writing why it is safe. The number the card was checked against is recorded either way, and it is a number GreCoM sets deliberately rather than a claim that you cannot be recognised.

GreCoM’s own reviewers can see who you are. They have to: to check your company against the trade register, and to read what you submitted. Every time a member of GreCoM staff reveals an identity or opens a document, the platform records who did it, when, and the reason they gave — on a log that cannot be altered afterwards, by anyone. GreCoM’s internal notes about your stream are held in a separate database role that the participant-facing application cannot read at all.

Your identity is released only when four things have happened: you expressed interest, the buyer expressed interest, one of you requested disclosure, and GreCoM approved that request. It is then released to that one buyer, at the same moment theirs is released to you. A request nobody answers expires after fourteen days.

Documents are handled separately. Anything you upload is scanned for malware, stripped of embedded metadata, and read by a person before anyone but you can open it. A counterparty can see a cleared document only after disclosure.