Trust centre
This product supports provisional assessment and evidence review. It does not certify legal conformity. Source controls, independently verified assurances and planned work have different meanings.
Versioned decision records
implemented in source · Independent assurance not established
Input and rule hashes are stored with cloud assessments. Independent legal approval is pending.
Accountable function: Product engineering. Reviewer: Not assigned. Review expiry: Not established.
Scope and supporting informationLocal deterministic processing
implemented in source · Independent assurance not established
Assessment answers stay in the browser in local mode. Optional cloud storage requires consent.
Accountable function: Product engineering. Reviewer: Not assigned. Review expiry: Not established.
Scope and supporting informationIndependent security certification
verification pending · Independent assurance not established
No SOC 2 or ISO certification is asserted by this trust centre.
Accountable function: Security owner. Reviewer: Not assigned. Review expiry: Not established.
Scope and supporting informationProcessor regions and retention
verification pending · Independent assurance not established
Production processor settings, backup expiry and contractual assurances require procurement verification. Optional AI narration remains disabled.
Accountable function: Privacy owner. Reviewer: Not assigned. Review expiry: Not established.
Scope and supporting informationCustomer adoption figures
verification pending · Independent assurance not established
No customer count is asserted without an approved measurement method and dated evidence.
Accountable function: Product owner. Reviewer: Not assigned. Review expiry: Not established.
Data flows and procurement
Local assessments use browser computation. Cloud workspaces use Supabase for authentication, database and document storage; Vercel hosts the application; Stripe processes payments; Resend delivers transactional email; Sentry supports diagnostics. Provider regions, retention settings and contractual coverage must be verified for the customer’s procurement requirements. Optional external AI narration is disabled.
Privacy and processing informationRequest the applicable data processing agreement and subprocessor details through the contact listed in the privacy policy. No executed DPA or certification is implied by this page.
Claim review
Public assurance claims require an accountable owner, a reviewer, scoped evidence and an expiry date. Expired or unapproved claims cannot be displayed as verified. Review is required at least quarterly and after a material security or processor change.