You are being asked to type your project's real risks into a browser: the supplier who is behind, the date nobody believes, the person who has not yet signed up to what they own. That is confidential material, and some of it is trade-secret material. What follows is where it goes, written to be read once rather than skimmed.
The CEI Work Session and the CEI Risk Coach Demo write nothing to a database. Your Cause, Effect and Impact go out to the coaching model, the response comes back, and no part of that exchange is stored.
There is one exception, and it is smaller than you would expect. So that a single visitor cannot consume the whole day's coaching capacity, requests are counted per visitor. The address is combined with a secret salt and hashed with SHA-256 before anything is written down, so what is stored is a count sitting next to a digest. It cannot be turned back into an address. The count survives, and the identifier never existed.
The client environment is different, because it has to be. Project Statements, Risk Action Plans and coaching transcripts live in a Supabase Postgres database in the United States. Traffic is TLS 1.2 or better with HSTS preload, and data at rest is encrypted by the infrastructure provider at AES-256 equivalent strength.
Every table carries row-level security scoped to your workbench. The distinction matters more than it sounds: a query that escapes its workbench returns nothing, rather than returning somebody else's Risk Action Plan and trusting the application to hide it on the way out.
Membership is explicit. A person is a member, an admin, or a consultant, and the consultant role is how I see your environment while we are working together.
The coaching response is generated by Anthropic's Claude API, which means the text of your Cause, Effect and Impact is sent to Anthropic. Under Anthropic's commercial API terms, inputs and outputs are not used to train or fine-tune models absent an explicit opt-in, and I have not opted in.
Anthropic retains inputs and outputs for up to thirty days for abuse and safety monitoring, then deletes them. Zero Data Retention is available from Anthropic under a separate agreement. The Workbench is not enrolled in it today.
Sign-in goes through Supabase Auth with an email address and a password, and a time-based one-time code is available as a second factor. There is no SAML or OIDC single sign-on today.
Access changes are written to an audit log: who added a member, who invited one, who removed one, who changed a role, and who changed which modules a workbench can see. A workbench admin can read their own workbench's log. The limit is worth stating plainly, because the word audit tends to promise more than this delivers. The log records grants of access, not uses of it. It will tell you who was given the Risk Action Plan. It will not tell you who opened it.
Amazon Web Services hosts the application in the United States, in us-east-2, and serves it through CloudFront. Supabase provides the database and authentication. Anthropic provides the model inference. Cloudflare provides DNS and does not proxy content. All four publish SOC 2 Type II attestations, with ISO 27001 additionally at AWS, Anthropic and Cloudflare.
Data is stored in the United States. The Workbench is a hosted service run by Celerity Consulting Group.
Your data exports in machine-readable form: Risk Action Plans as .xlsx, Project Statements as .docx. Nothing about the Workbench requires you to keep your risks inside it.
A data processing addendum is available on request.