An honest look at how we protect your assessment data today — and our roadmap for enterprise-grade compliance.
Hosted on AWS EC2 with Cloudflare SSL/CDN. All data transmitted over TLS 1.3. Application behind Cloudflare WAF.
Item text is processed in memory and persisted to databases running on our own AWS infrastructure: PostgreSQL for accounts and engagements, and a local MongoDB instance for single-item analysis logs and shared reports. For engagement customers, data is retained for the duration of the engagement + 30 days, then deleted unless written consent for retention is provided.
LLM analysis is performed via Anthropic's Claude API. Anthropic does not train on API inputs. Item text is sent over TLS to Anthropic's API. Under Anthropic's standard commercial terms, API inputs and outputs may be retained for a limited period for trust-and-safety purposes; zero-data-retention terms can be arranged for enterprise engagements.
Operator console is protected by form-based authentication with bcrypt-hashed passwords. Customer accounts use email-and-password authentication with hashed passwords and server-side sessions. Engagement deliverables are also available via signed URLs.
| Standard | Status |
|---|---|
| SOC 2 Type II | Planned — not yet certified |
| HIPAA BAA | Available for Enterprise |
| GDPR | DPA Available on Request |
| ISO 27001 | Roadmap 2027 |
Found a security issue? We appreciate responsible disclosure.
[email protected]