Security and privacy
Private copy review. Clear data choices.
This page describes how the checker is built today. It is a description, not a certification, and we don't claim an outside audit.
The short version
- The rule check, the on-device model read, proofs, overrides, approval and exports run in your browser.
- The application requires a Clerk account and an active workspace. Authentication uses cookies and sends account and security data to Clerk. The copy you check is not sent to Clerk or our account server.
- The AI second read is the one place text leaves your browser. It sends the text to Anthropic's API with your own key, and only after you tick a consent box and press Run.
- Don't paste patient information. The product is not built for it.
The one place text can leave
The AI second read sends the text, and the blocking rule findings, to Anthropic so it can return comments. The key you type is held in memory only and is never stored. Nothing is sent before you consent. An end-to-end test checks that, and it checks that no request carries your text on any other path.
A separate standalone AI page does the same job without the approval record, with its own page-level policy. Anthropic's terms and privacy policy govern what happens to the text once it arrives. There is no business associate agreement with Anthropic, so patient information must not go through it.
What is stored on your device
| Where | What | When |
|---|---|---|
| Page memory | The text, your choices, proofs, overrides, approver details, custom policy, and the API key if you type one | Gone when you close or reload the page |
| Browser storage (IndexedDB) | Saved checks, including the full text | Only if you switch on "Keep history in this browser". Off by default. Stays until you delete it. |
| Browser storage (IndexedDB) | A signing key. The private half cannot be read back out by the page. | Created on your first export. Clearing site data deletes it. |
| Browser storage (local) | Whether history is on, and whether the model read is off | Until you clear site data |
| Tab session storage | The text, when you open the standalone AI page from the checker, so it arrives filled in | Until you close the tab |
| Authentication cookies | Clerk session information identifying your account and active workspace | Managed by Clerk; signing out ends your application session |
Source: the checker's code, read when this page was written
Local history, signing keys and carried AI text are separated by user and workspace. We cannot recover your local copy or reports. Clearing the site's data in your browser removes them.
How it is enforced
- Per-page Content-Security-Policy. Application pages allow Clerk's authentication and security resources. Only the checker and standalone AI page also allow Anthropic's API. The model files and WebAssembly runtime load from the same site.
- Consent first. The AI second read stays disabled until the consent box is ticked.
- Signed exports. Reports are signed with an ECDSA P-256 key the browser holds as non-extractable. Verification rejects edited reports. It does not prove who made one, so keep the key fingerprint somewhere independent.
- Crafted reports. Custom rules in a report are rebuilt from their phrases, so a report can't smuggle in its own pattern.
- Tests. Browser tests run against the production headers and cover privacy, the policy per page, signing, the AI gate and accessibility.
What we collect
Clerk processes account, membership, session and authentication security data. Our application reads membership and seat information. Our hosting provider may keep ordinary server logs, such as IP address, time and page requested, for security and operations. If you email us, we receive what you send. The feedback links in the checker pre-fill the rule id, the rule-set version, the content type and the matched phrase. For patient-privacy rules they leave out the phrase.
What we do not claim
- No certification of any kind, and no claim that using this tool makes you meet any law.
- No outside security audit or penetration test.
- No protection for patient information. Keep it out.
Next step
Review your copy with clear data choices.
Use the local review flow, or choose an external AI second read only after reviewing how it handles your copy.