Where the data lives,
and what we actually claim.
This page is designed for a procurement officer’s security questionnaire. If a specific line item is missing, email us via the contact pageand we’ll add it here.
Where everything sits
Next.js 16 on Vercel (US regions). TLS in transit. No advertising or third-party ad trackers anywhere on the site. PostHog product analytics is optional and inactive unless a key is configured.
Optional sign-in via Supabase Auth (email + password); participation does not require an account. Password reset uses one-time links. Account deletion is permanent and in-app (/account): all rows linked to the account are deleted, then the login.
Supabase Postgres (us-east-2). Encrypted at rest (AES-256). Daily backups. Row-level security enabled on all tables with no public access policies; the browser never talks to the database directly — all data access goes through server routes. Interview transcripts are not stored here.
Anthropic Claude Sonnet 4.6 (interview mediator, extraction, grouping concerns during synthesis) and Haiku 4.5 (value-profile ratings, group labels). Anthropic does not train on API data and retains it only under its commercial API data-retention terms. Emails, phone numbers, ID and card numbers, street addresses and URLs are redacted by pattern before text reaches the model; personal names cannot be reliably detected, so participants are asked not to share them.
IndexedDB (Dexie) holds your interview transcript (the only copy — it is not stored server-side) and a local copy of your saved perspective and receipt. Transcripts are auto-deleted after 30 days; everything local is cleared when you delete your data from /my-data or clear your browser storage.
Everyone who touches the data
| PROVIDER | PURPOSE | REGION |
|---|---|---|
| Vercel | Hosting, CDN, edge functions | US |
| Supabase | Postgres, Auth, Storage | US (us-east-2) |
| Anthropic | LLM inference (mediator + extraction) | US |
| PostHog | Optional product analytics (inactive unless configured) | US/EU |
| Sentry | Error tracking (inactive until configured) | US |
| Resend | Transactional email (sign-up verification, password reset) via Supabase Auth SMTP | US |
| Stripe | Subscription billing for customer organizations (inactive until configured; never used for participants) | US |
| OpenTimestamps calendars | Public timestamping of published Merkle roots (receives only a salted hash, no personal data) | Public |
What we do today— and don’t claim yet
What we do today
- ◇TLS in transit, AES-256 at rest, daily backups
- ◇Transcripts never stored server-side; kept in the browser, auto-deleted after 30 days
- ◇Pattern redaction of structured identifiers before AI processing or storage
- ◇Anonymous session IDs stored only as SHA-256 hashes
- ◇Row-level security on all tables, no public policies; all access via server routes
- ◇Database-backed per-IP rate limits on every AI and write endpoint, plus a global daily cap on AI calls
- ◇Admin endpoints and scheduled jobs refuse access unless their secrets are configured
- ◇Self-service withdraw, export and delete; in-app account deletion
- ◇Merkle-tree provenance for every published synthesis version (/api/verify), with each root timestamped in Bitcoin via OpenTimestamps (/provenance)
What we don't yet claim
- ◇SOC 2 Type II — not certified. We follow the practices but have not been audited.
- ◇ISO 27001 — not certified.
- ◇HIPAA — the platform is not currently marketed for PHI-adjacent use cases; ask us if you have one.
- ◇FedRAMP — not applicable to current deployments; can be discussed for a specific procurement.
- ◇On-premise / air-gapped deployment — not offered today.
- ◇Personal-name detection — names cannot be reliably redacted by pattern; we rely on instructions to the extractor and to participants.
- ◇Point-in-time recovery — backups are daily.
Vulnerability disclosure
Found something? Please report it via the contact page with as much detail as you’re comfortable sharing. We aim to acknowledge within 3 business days. We do not currently run a paid bug bounty; a public thank-you and a fixed root cause are what we can offer today.
Good-faith research is welcome. Do not access other participants’ data, do not run traffic-generating scans against production without contacting us first, and do not publicly disclose before we’ve had a reasonable window to fix.
Related: Privacy Architecture · Participant Rights · Procurement FAQ