Security

Encryption in transit

All traffic to the app and API is served over HTTPS with TLS. There is no unencrypted endpoint.

Hosting

The application runs on Microsoft Azure in the Central US region, on infrastructure managed and patched by Microsoft. Customer environments are isolated per deployment.

Session-first design

The assessment workspace keeps your inputs in session memory while you work. We don't build advertising profiles, and we don't mine your assessment data.

API authentication

Every API call outside the public health endpoints requires a bearer token. Endpoints that write data reject anonymous requests.

What we never do

• Sell or rent your data to third parties.
• Use your assessment inputs to train models.
• Grant third parties access to your workspace without your instruction.

Certified cloud foundation

Built on Microsoft Azure and Cloudflare's edge network. Our infrastructure inherits Azure's independently audited certifications — SOC 1/2/3, ISO/IEC 27001, HIPAA/HITECH, FedRAMP, and PCI DSS — plus Cloudflare's always-on DDoS mitigation, Web Application Firewall, and TLS 1.2+ encryption. Same model as Stripe: their PCI-certified checkout means your card data never touches our servers.

Shared responsibility, stated plainly

Azure's certifications cover Microsoft's physical infrastructure and cloud controls — not our application layer, which we secure separately: bearer-token API authentication with fail-closed defaults, encrypted sessions, and no training on your data. We inherit the foundation's audits and own our app's.