What happens to what you type.

What you type stays on your screen.

The exercises linked from this site keep what you type on your screen. Nothing is written to a database unless you ask to receive a copy, in which case the address you give us and the text you asked us to send go through our email provider, we keep our copy, and I may use the address to follow up. Your Cause, Effect and Impact go out to the coaching model, and the response comes back.

There is one more thing kept, and it is smaller than you would expect. So that a single visitor cannot consume the whole day's coaching capacity, requests are counted per visitor. The address is combined with a secret salt and hashed with SHA-256 before anything is written down, so what is stored is a count sitting next to a digest. It cannot be turned back into an address. The count survives, and the identifier never existed.

The client environment is different, because it has to be. Project Statements, Risk Action Plans and coaching transcripts live in a Supabase Postgres database in the United States. Traffic is TLS 1.2 or better with HSTS preload, and data at rest is encrypted by the infrastructure provider at AES-256 equivalent strength.

Row-level security in the database, not a filter in the application.

Every table carries row-level security scoped to your workbench. The distinction matters more than it sounds: a query that escapes its workbench returns nothing, rather than returning somebody else's Risk Action Plan and trusting the application to hide it on the way out.

Membership is explicit. A person is a member, an admin, or a consultant, and the consultant role is how I see your environment while we are working together.

Your words leave the application. This is where they go.

The coaching response is generated by Anthropic's Claude API, which means the text of your Cause, Effect and Impact is sent to Anthropic. Under Anthropic's commercial API terms, inputs and outputs are not used to train or fine-tune models absent an explicit opt-in, and I have not opted in.

Anthropic retains inputs and outputs for up to thirty days for abuse and safety monitoring, then deletes them. Zero Data Retention is available from Anthropic under a separate agreement. The Workbench is not enrolled in it today.

A password, a second factor, and a log of who was let in.

Sign-in goes through Supabase Auth with an email address and a password, and a time-based one-time code is available as a second factor. There is no SAML or OIDC single sign-on today.

Access changes are written to an audit log: who added a member, who invited one, who removed one, who changed a role, and who changed which modules a workbench can see. A workbench admin can read their own workbench's log. The limit is worth stating plainly, because the word audit tends to promise more than this delivers. The log records grants of access, not uses of it. It will tell you who was given the Risk Action Plan. It will not tell you who opened it.

Four companies, and what each one holds.

Amazon Web Services hosts the application in the United States, in us-east-2, and serves it through CloudFront. Supabase provides the database and authentication. Anthropic provides the model inference. Cloudflare provides DNS and does not proxy content. All four publish SOC 2 Type II attestations, with ISO 27001 additionally at AWS, Anthropic and Cloudflare.

Data is stored in the United States. The Workbench is a hosted service run by Celerity Consulting Group.

It leaves in the formats you already work in.

Your data exports in machine-readable form: Risk Action Plans as .xlsx, Project Statements as .docx. Nothing about the Workbench requires you to keep your risks inside it.