Data & security
The most sensitive data in a breach response is the list of affected people. So we designed the product never to hold it.
We never store affected-individual PII
When you upload a spreadsheet to tally residents by state, the parsing happens entirely in your browser. Only the per-jurisdiction counts are kept, never names, addresses, or identifiers. The file itself is never transmitted. This is both a liability firewall and the honest answer to the first question every buyer asks.
The calculator stores nothing
It runs entirely in your browser. The incident facts you enter and any spreadsheet you tally never leave your device.
Your matters, access controlled
Matters in the workspace are isolated to your organization, encrypted in transit and at rest, and can be deleted at any time.
How AI is used
Obligation determinations and deadlines are computed deterministically, no model is involved. A language model assists only with prose drafting between fixed clauses and with mapping a pasted incident description onto structured fields, always under a deterministic validator and your review. Model calls exclude client identifiers and are not used to train third-party models.