Security and trust.
Where workspaces are hosted, how access works, and what we hold.
Hosting and isolation
Each customer workspace runs as its own deployment on Cloudflare Workers and Containers, serving an immutable, versioned release over HTTPS. Sign-in identities and workspace memberships are held in Supabase, in its West EU (Ireland) region, and are managed by Abscissa. That identity store is shared across workspaces and operated by us; it is not separate customer-owned infrastructure. Nothing installs or executes on your network.
Sign-in and access
Users sign in with an email address and password on their own workspace's address. There is no public sign-up and no anonymous access. Single sign-on and multi-factor authentication are not offered yet. Membership is granted and revoked by Abscissa on the customer's instruction. Every data request re-checks the user's identity and active membership, so a revoked membership takes effect on the next request. Sessions last at most one hour, with no refresh token kept. Session cookies are host-only, Secure, HttpOnly and SameSite=Strict. Workspaces are read-only for their users.
What we hold
Public corporate disclosures in their original published form, and the items extracted from them, each with its citation. Benchmark and registry data as published by the assessor.
What we do not hold
No paywalled ratings data. No information from inside any company. Customer documents are not required and are not stored in the current version of the platform.
Machine reading
Public documents are read and extracted on our side before a workspace release is built, and a person checks items before they are marked validated. Where that work uses a third-party AI model (currently Anthropic's Claude), the model receives public documents only. A workspace serves the prepared evidence: it makes no calls to any AI model provider, so your questions and your users' activity are never sent to one.
Evidence standard
Every finding carries a verbatim quote and a page citation. Machine-read items are marked as candidates until a person has checked them. Absence is stated as "not found in the reviewed sources", with the sources named. The platform never states that a company complies with, is aligned to, or meets a requirement; those are judgements for your advisers.
Vendor review
Send your vendor-review questionnaire to the sales team and we will answer it in writing.