LastPass sustainability score: 28/100

No Scope 1 or Scope 2 emissions data has been found in any public source for LastPass as an independent company (spun off from GoTo in May 2024). The ESG report page (lastpass.com/resources/reports/esg-report) returned negligible content in searches, with no emissions figures extractable. No national GHG registry filing was located (US private companies of this scale are not mandated to file). No CDP disclosure found. Prior to the spin-off, sustainability was reported under parent GoTo's framework; those historical figures cannot be attributed to the standalone entity. Estimated total operational emissions for a ~700-800 person software company with cloud-dependent operations and no owned manufacturing are well under 10,000 tonnes CO₂e — likely in the 1,000–5,000t range. Per the rubric, a mid-sized company without formal disclosure but with an estimated footprint under 10,000 tonnes scores 2. The lack of formal reporting post-spin-off is the key finding, not catastrophic physical impact.

No Scope 3 data has been published by LastPass as an independent company. The supply chain for a SaaS password management company is relatively limited compared to physical goods sectors: primary upstream impacts are cloud/data centre energy (likely AWS or similar hyperscaler), hardware procurement for offices, and employee business travel. Downstream use of LastPass's software product has negligible direct emissions (a browser extension and app). The supply chain is not particularly complex — no manufacturing, no physical retail, no large logistics network — which limits the ceiling of undisclosed impact. However, no formal assessment, supplier engagement programme, or Scope 3 estimate has been found. Score of 2 reflects an inherently short, low-impact supply chain with zero public evidence of formal assessment.

No emissions trajectory data exists for LastPass as a standalone entity. The company only became independent in May 2024, so there is no multi-year baseline available under the new corporate structure. No historical emissions data was found in public sources — neither under the new entity nor broken out separately from the former parent GoTo's reports. Without any baseline year data, no trajectory can be assessed. For a mid-sized, growing software company with PE backing and no public emissions record, no trajectory evidence scores 1 under the rubric. The company's growth trajectory (it has expanded its user base and product portfolio since the breach recovery) suggests emissions are unlikely to be falling. Score of 1 reflects mid-sized company with no trajectory evidence.

No renewable energy data, green tariff, or energy strategy has been found for LastPass as an independent company. No RE100 membership, no PPAs, and no on-site generation have been identified. The company's primary energy use is likely through cloud/data centre providers (hyperscalers such as AWS, Azure, or GCP, who have their own renewable programmes) and office electricity. However, LastPass itself publishes no information about its energy sourcing choices, making it impossible to credit any renewable procurement. A software company with a small physical footprint and no evidence of active energy strategy scores 2 — minimal energy consumer with no formal strategy. This is not scored 0 because the inherent energy consumption of a ~700-800 person SaaS company is low relative to heavy industry.

LastPass has minimal direct nature exposure as a purely digital software company — no land use, no deforestation risk, no physical extraction. A 2022 blog post (predating the spin-off, under GoTo ownership) referenced a partnership with the Arbor Day Foundation to plant trees in the Klamath Falls Basin following wildfire, describing it as an onboarding-linked initiative. This initiative cannot be credited to the independent post-2024 LastPass entity, and it was marketing-adjacent in character (triggered by user onboarding). No current biodiversity policy, TNFD disclosure, or nature risk assessment has been found for the standalone company. The score of 3 reflects genuinely negligible direct nature impact (appropriate for a digital services company) with basic historical awareness, but no formalised current policy.

No resource use, waste management, or circular economy data has been found for LastPass. As a software company, material resource use is limited to office consumables and hardware (laptops, servers if any owned infrastructure). No supplier sustainability requirements, hardware lifecycle management programme, or e-waste policy has been identified in any public source. The legal center references a Supplier Code of Conduct that sets out legal and ethical expectations for suppliers, but environmental requirements within it are unknown — no content was accessible to verify environmental provisions. Score of 2 reflects basic awareness implied by existing governance documents, but no evidence of active waste minimisation or circular procurement practices.

LastPass is a SaaS company with no manufacturing, no process water use, and no chemical discharge risk. Water impact is confined to office consumption and, indirectly, any owned or leased data centre cooling (though LastPass appears to use third-party cloud infrastructure rather than owned data centres). No water data, water stewardship programme, or water policy has been found. However, for a genuinely low water-impact service business, the rubric allows a score of 4–6 for companies with negligible water impact and awareness of that fact. LastPass scores at the lower end of this range (4) because no water monitoring or formal statement has been published — the low physical impact is structural, not the result of active stewardship.

No science-based targets, net-zero commitments, or formal emissions reduction targets have been found for LastPass as an independent company. No SBTi commitment or registration was identified on the SBTi target dashboard. No CDP submission was found. The ESG Principles document referenced on the legal center page exists, but no quantified targets with timelines have been located in any public source. A company with no measurable targets and no baseline data scores 1 — informal goals without specifics, which is the only category that fits given the ESG Principles document exists without quantified climate commitments. The company's recent spin-off in 2024 may partly explain the absence of formal targets, but this does not change the physical reality of no commitment having been made.

LastPass publishes an ESG Principles document (referenced on its legal center page) and has a dedicated ESG report page on its website. The company also maintains a Supplier Code of Conduct. However, no emissions data, no specific sustainability targets, no board-level sustainability governance structure, no TCFD or CSRD disclosure, and no third-party verification of any environmental data have been found. The company is privately held under PE ownership (Francisco Partners and Elliott Investment Management), which reduces mandatory disclosure requirements. As a private company with a documented ESG framework but no quantitative environmental disclosure, it scores 3 — sustainability is a documented priority with an assigned framework, but key data is not publicly available.

No environmental controversies, greenwashing rulings, regulatory fines relating to environmental matters, climate lobbying activity, or adverse NGO findings have been identified for LastPass. The significant 2022 data breach and the resulting UK ICO penalty of £1,228,283 (for GDPR/data protection failures, not environmental matters) are security/privacy issues outside the scope of environmental scoring and are not deducted here. InfluenceMap has no profile for LastPass, indicating the company is not a significant climate policy actor in either direction. LastPass is a password management SaaS company with no structural exposure to fossil fuel clients, no advertising or finance enablement of fossil sectors, and no identified trade association membership with climate-adverse lobbying positions. Start at 8, deduct 1 for the general absence of proactive positive climate advocacy or lobbying audit — the company has not published evidence of positive climate engagement. Score: 7.