Security

Plan documents are confidential. We treat them that way.

What we do today, what is still being confirmed, and how to get the full written security summary.

Built into the product

These are properties of how the analyzer works, not promises about infrastructure.

Every file is identified by its SHA-256 fingerprint, so a report records exactly which documents it was built from.

Each finding quotes the extracted text and names the file, so a reviewer can check it against the original.

Automated quality controls compare the numbers, counts and wording in a report. If they disagree, the report is marked not approved for release.

The plan name on the report is the one you enter, not text taken from the documents.

Answers marked “to be confirmed” will be completed before launch.

Where are documents processed?

The analyzer runs as a desktop application on the user’s own computer. [To be confirmed before launch, including any hosted option.]

Are documents sent to a server?

[To be confirmed.]

How long is data kept?

[To be confirmed: retention and deletion.]

Who can access it?

[To be confirmed: roles and access controls.]

Is data encrypted?

[To be confirmed: in transit and at rest.]

Which independent assessments exist?

[To be confirmed: audits, penetration tests or certifications. None are claimed here.]

Ask for the security summary and send us your vendor questionnaire. Please do not send plan documents or participant data with your request.