Who can see it
Joe, and the AI agents working on your engagement, each with scoped permissions. Each client or matter has its own storage, index, glossary and logs. Planted-leak tests must all be caught before a release.
Your data
How we handle your data
This website loads nothing from anyone else and sets no cookies. In client work, your data stays inside the boundary you approve and is not used to train models.
Written for the person in procurement or IT who has to forward something. For the legal version, see the privacy notice (draft).
This website
What happens when you visit
- Every file comes from this site. There are no third-party scripts, fonts, pixels or embeds.
- No cookies. No forms. No sign-up.
- The site tells your browser to block anything else: its Content-Security-Policy header allows only this site's own files (default-src 'self') and blocks all outgoing data requests (connect-src 'none'). The full header list.
- Links to other sites send no referrer.
- The hours calculator on the Fridays page and every demo run in your browser on made-up data. What you type is not sent. The time-log demo keeps your entries in this browser only if you switch saving on.
- If you choose to install the demos for offline use, your browser keeps a copy of the demo pages. Remove it from the Demos page at any time.
- If you use the light or dark switch, your browser remembers that one choice in its own local storage. It never reaches us.
- If you email us, we have your email. We use it to reply, and nothing else.
- The site is hosted on Cloudflare Pages. [PLACEHOLDER: what Cloudflare's logs record for this site, who can see them and for how long, checked against the account settings]
Client work
Where your data lives in an engagement
| Option | Where your data sits | What comes out |
|---|---|---|
| On your premises | Hardware you own, on your network | Approved deliverables only |
| In your cloud account | Your own Azure, AWS or Google Cloud tenancy, under your access controls. You pay your own compute. | Approved deliverables only |
| Hybrid | Methodology in one copy, your data in another, nothing raw crossing between them | Approved deliverables only |
Model training
Your data is not used to train models. That is a proposed default term in every statement of work.
[PLACEHOLDER: default terms on this page come from the proposed SOW defaults; confirm with counsel before publishing]
Outside services
Any model API call, telemetry, backup or subprocessor that touches your material is listed and agreed in writing first. Cloud providers' own data terms apply inside your tenancy; we review them with you.
Getting it back
You own the deliverables once they're paid for. At the end of an engagement you receive the deliverables, the logs and the configuration.
[PLACEHOLDER: retention and deletion period after an engagement ends, set per SOW]
What we don't claim
Plain limits
- We hold no security certification today. We don't claim SOC 2, ISO 27001 or similar.
- "Audit-grade" describes logged, reviewable work. It is not a certification or an audit opinion.
- "Kept local" is the standard each deployment is built to. We use it about a specific system only after that system passes its acceptance checks, including where model calls, telemetry, logs and backups go.