What we store, and what we do not

What we store

Account data

Your name, email address, and profile image if your identity provider supplies one, plus a record that your email was verified. We support Google sign-in and emailed sign-in links. We never store a password — the product has no password field anywhere. Sessions live in our database, so signing out actually revokes them.

Assessment data

Your answers, any notes you write, your evidence-confidence ratings, and the findings and frozen result snapshot produced when a run completes. Completed runs are immutable by design: we keep them so your history stays meaningful.

Organization data

Organization name, slug, description, membership and roles, selected focus areas, and any architecture profile you confirm. Access is derived from membership on every request — we never trust a role claim sent by the browser.

Evidence files

Files you attach to roadmap items or checklist runs are stored on our server's disk, not in a third-party bucket. Only a short allowlist of types is accepted (PDF, PNG, JPEG, Markdown, plain text, CSV, JSON), the declared type is checked against the file's actual bytes, and downloads are always served as attachments. Filenames you upload are kept only as a display label; the stored path is generated.

Search queries

Public search stores the text you typed, alongside how many results it returned. We use it to find gaps in our content. Do not type anything sensitive into the search box.

Audit and security records

Administrative and organizational changes are recorded in an append-only audit log. Metadata is filtered before it is written: anything token-, secret-, credential-, evidence- or payload-shaped is dropped. Raw IP addresses are never stored — only a salted one-way hash, which cannot be reversed to an address without our server secret.

Product analytics

Analytics is first-party: events are written to our own database and sent to no advertising or marketing platform. Only these 12 event types can exist, and each one may only carry a small allowlist of values — counts, identifiers and enums, never free text:

• focus_area_viewed
• assessment_started
• assessment_completed
• assessment_abandoned
• roadmap_generated
• roadmap_item_completed
• report_generated
• report_pdf_failed
• search_performed
• feedback_recommendation
• feedback_scoring
• demo_preview_viewed

Your answers, findings text, evidence and search text are rejected before they can reach this stream — that rule is enforced in code, not by convention. You can turn analytics off for your browser with one click on the analytics & privacy page.

Cookies

We set no advertising or tracking cookies, and we embed no third-party analytics script. Three cookies exist, all first-party and all functional:

• Sign-in session — identifies your signed-in session. HttpOnly, SameSite=Lax, and Secure in production. Removed when you sign out.
• Guest assessment (ops_guest_run) — lets you run a quick assessment without an account and come back to it. It holds a random token, nothing about you.
• Analytics opt-out (opsrx_analytics_optout) — remembers that you asked us not to record product analytics.

If the AI layer is enabled

The AI layer is optional and off unless an operator explicitly configures a provider, a key and a destination. The core product — assessments, scoring, roadmaps, reports — works fully without it. When it is on:

• Only three things can be sent: a system description you type yourself, the frozen numbers of a completed result, and approved catalog text for a recommendation.
• Your evidence files and raw answers are never sent. Text that looks like a credential is refused before any request leaves our server.
• Generated output is never stored as fact and never becomes a score. We record only that a request happened, with the provider, model, prompt version and a one-way hash of the input — never the text, and never any model reasoning.
• The provider processes whatever is sent under its own terms. Operators enabling this layer are responsible for choosing a provider whose data handling they accept.

Who else sees it

• Members of your organization, according to their role. Someone who is not a member cannot discover that your organization exists — unauthorized requests are answered as “not found”, never “forbidden”.
• Our email provider delivers sign-in links and invitations. It sees the recipient address and the message.
• Our hosting provider operates the server your data sits on.
• An AI provider, only if an operator enabled that layer, and only the minimal context described above.

We do not sell data, and we do not share assessment content with anyone else.

Retention, and what is not built yet

Being straight about the gaps matters more than sounding complete:

• No automatic deletion schedule exists yet. Data is kept until you or your organization's owner removes it, or until you ask us to.
• Organization deletion is self-serve for owners, and removes the organization's data with it.
• Account deletion and data export are not yet self-serve. Ask us and we will do it by hand.
• Evidence files cannot yet be deleted from the interface. Ask us and we will remove them.
• Encrypted backups exist for disaster recovery, so deleted data may persist in a backup for a period after removal.
• Audit records are append-only by design and are not deleted when other data is.

Asking us about your data

To request an export, a deletion, or anything else described above, use the contact page. Until the self-serve tools exist, a human does it.