Security

Encryption in transit

All traffic to the app and API is served over HTTPS with TLS. There is no unencrypted endpoint.

Hosting

The application runs on Microsoft Azure in the Central US region, on infrastructure managed and patched by Microsoft. Customer environments are isolated per deployment.

Session-first design

The assessment workspace keeps your inputs in session memory while you work. We don't build advertising profiles, and we don't mine your assessment data.

API authentication

Every API call outside the public health endpoints requires a bearer token. Endpoints that write data reject anonymous requests.

What we never do

• Sell or rent your data to third parties.
• Use your assessment inputs to train models.
• Grant third parties access to your workspace without your instruction.