We would rather under-claim than over-claim. Everything below describes what the software does today, not what we intend to build. Where a capability does not exist yet, this page says so.
The marketing site you are reading now has no analytics, no tracking pixels, and sets no cookies. There is no consent banner because there is nothing to consent to.
Its two forms are the free classification lookup and the free predicate search. What you type is sent to FDA's openFDA database to find matching records and is not saved by us. Your IP address is held in memory for up to an hour, only to limit how many searches one visitor can make.
One disclosure: the fonts on this site and in the app are served by Google Fonts, so loading a page sends your IP address, browser user-agent, and referring page to Google. We plan to self-host the fonts and remove that dependency.
Everything in this section applies once you sign in at the app.
One cookie, rc_session, set when you sign in. It holds a random token; only a SHA-256 hash of that token is stored on our side, so the database cannot be used to impersonate you. It is HttpOnly (unreadable by JavaScript), SameSite=Lax, and marked Secure in production. It lasts 14 days and renews while you are active. Signing out deletes it; changing your password ends every other session.
This cookie is strictly necessary to keep you signed in. We set no advertising, analytics, or third-party cookies anywhere in the product.
A regulated quality system has to record who did what. We store the IP address and browser user-agent against your sign-in sessions and password-reset requests, and the IP address against entries in the audit trail. If a workspace owner shares a device with you through a read-only link, opening the page and each download are recorded in that workspace's audit trail with your IP address; no account or other detail about you is involved. Audit entries also record the action, the affected record, and before/after snapshots of what changed.
The audit trail is append-only and enforced as such by the database itself, so it cannot be edited or deleted, by us or by you. That is the point of it, and it has consequences for deletion (below).
Device profiles, requirements, risks, tests, documents, and uploaded files belong to you. Uploads are stored on an encrypted volume in the United States and are addressed by a hash of their contents rather than by filename. We do not scan uploaded files for malware, and we do not send their contents to any third party.
Inside the app (not on this website) we record which features are used, so we can tell what helps and whether people come back. Each record holds: the feature (for example “opened the traceability matrix”), when, which workspace, and a random ID that stands in for you. It does not hold your name, email, IP address, anything you typed, or which record or document you were looking at. It is recorded by our server, so there is no tracking script or cookie in your browser, and it stays in our own database: no analytics company sees it. It is deleted after 13 months.
Your identity provider, if your workspace uses single sign-on. When you sign in through your company's provider, it tells us your email address, your name and an identifier for you; we use them to sign you in and to add you to that workspace. We send the provider nothing about your records.
AI clients you connect yourself. If you add the read-only connector to Claude or another AI client with your own API token, that client reads what you ask it to, and its provider handles that data under your agreement with them, not ours. We record each read as ordinary use of your account. Revoking the token stops it at once.
We do not sell your data, we do not share it for advertising, and we take no payment information. Nothing is charged today, so there is no payment processor.
Every record carries a workspace identifier, queries are scoped to the workspace you are working in, and PostgreSQL row-level security enforces the boundary underneath the application as a backstop. The database role the application uses cannot bypass it. This matters most for consultants: one client's data is not visible while you are working in another's.
Passwords are hashed with argon2id and must be at least 10 characters. Sign-in and password-reset attempts are rate-limited. State-changing requests carry a CSRF guard. Access within a workspace is governed by roles, and people who are not members of a workspace cannot confirm it exists. Traffic is served over HTTPS.
No system is perfectly secure, and this one is young. We would rather you knew that than read a paragraph of reassurance.
We keep your data for as long as your account exists. A workspace owner can download the whole workspace as one export at any time. There is no self-service delete yet. Email us and we will delete your workspace and its contents by hand.
Two honest caveats. The audit trail is append-only at the database level, so entries recording who took an action are retained for records integrity even after the underlying record is removed. That is a deliberate property of a quality system, not an oversight. And there is currently no scheduled job that purges expired sessions or old logs; that cleanup happens manually.
If you are subject to GDPR, CCPA, or similar and need something we cannot yet do automatically, write to us and we will handle it manually.
Stated explicitly, because quality-system vendors routinely imply otherwise:
If this policy changes materially, we will update the date at the top and tell account holders in the app (and by email, once email is switched on).
Questions, deletion requests, or anything else: [email protected].