Security

Signed-in accounts and organization workspaces store Programs, conversations and report editions on the server. Each request checks identity and access for its records. Planning views run in the browser; saving and report capture use server services. Separate services retain expiring Share snapshots, product-use events and optional feedback. SurveyMonkey follow-up opens a separate external link.

The event endpoint accepts an exact versioned schema, same-origin mutations, fixed enums, a small request body, idempotent event IDs and a global daily limit. It hashes random tab-session and creation-attempt identifiers before insertion, honors Global Privacy Control and Do Not Track, and exposes aggregates rather than raw rows.

The feedback endpoint is separate from passive events. It accepts an exact versioned schema, same-origin requests, a streamed 2 KiB body limit, idempotent response IDs, fixed choices, bounded text, and per-session and global daily limits. It stores only a digest of the random tab-session identifier. Raw cancellation details are never returned by the Usage endpoint.

The application offers the detailed collector only after a successfully submitted score of 9 or 10. The exact HTTPS link has no parameters or product-state interpolation, opens with referrer suppression, and sends no NPS score or program data from AI Security Planner. A server-only token checks the fixed collector hourly and stores only its response total, timestamps and bounded failure codes. Answers and respondent metadata are not stored by this check. The owner separately reviews results and commits only schema-validated answer totals and bounded quote text with quotation permission. Raw SurveyMonkey responses and service metadata never enter the AI Security Planner source tree.

Stored programs use bounded, versioned schemas. Writes preserve the prior valid record when possible, revision checks stop stale overwrites, and unreadable bytes are not silently replaced.

JSON import checks file type, size, structure, schema version, checksum, and the complete project before replacement is confirmed. CSV formulas are neutralized, Markdown control characters are escaped, and user text is rendered as text rather than executable markup.

Program dates, blockers, notes, reports, shared snapshots, and exported files may still be sensitive. Device access, browser profiles, active links, downloaded files, destinations, and backups remain part of the user's security boundary.

Public release remains blocked until deployment security headers, network behavior, supported browsers, accessibility, locales, and exact production revision evidence pass the recorded launch gate.