GxP Governance Assessment Engine
Short version: The Engine collects only what’s needed to provide the assessment service and run the platform. Your data is stored in the US on Supabase (AWS us-east-1). It is not used to train models, shared with third parties for marketing, or sold. You can request deletion at any time.
Access request form submissions: Name, work email, organisation name, organisation type, job title, regulatory frameworks, use case description, system count estimate, current tooling, decision-maker status, referral source. Used to evaluate and process access requests.
API call data (assessment audit log): For each assessment API call, we record: organisation ID, API key identifier (prefix only — not the full key), system type requested, assessment category, regulatory frameworks requested, governance decision returned, templates applied, trust score, required actions count, call duration, status (completed / failed). This is the audit trail required for regulatory defensibility of the platform itself.
API credentials: API keys are hashed with SHA-256 before storage. The full key is shown once at provisioning and is not recoverable. The stored hash cannot be reversed to the original key.
Email subscriptions (Validation Futures): Email address and the article page from which you subscribed. Used only to send Validation Futures perspectives.
Website usage: Standard server logs (IP address, browser type, pages visited, timestamps). Not linked to assessment activity.
Primary database: Supabase (PostgreSQL), hosted on AWS us-east-1 (Northern Virginia, United States).
Email delivery: Resend, used only to transmit confirmation and notification emails. Resend does not retain email content beyond delivery.
Stripe: Payment processing. Stripe stores billing information under its own privacy policy. We store only the Stripe customer ID and subscription ID in our database.
No data is stored in the EU, UK, or any other jurisdiction. If your organisation’s data residency requirements require non-US storage, contact us before requesting access.
Data collected through the platform is used exclusively for:
Your data is not used to train machine learning models, improve assessment outputs for other customers, or derive competitive intelligence. Assessment outputs generated for your systems are not shared with any other organisation.
Access request records: Retained for the lifetime of the commercial relationship plus 3 years for record-keeping purposes.
Assessment audit log: Retained indefinitely. These records are part of the platform’s regulatory audit trail and cannot be selectively deleted without compromising audit integrity. On account termination, audit log records are anonymised (org ID and API key ID replaced with a non-reversible hash) rather than deleted.
API credentials (hashes): Retained until revoked. Revoked key hashes are retained for 1 year to detect and block replay attempts.
Email subscription records: Retained until unsubscribed plus 30 days. Unsubscribe by replying with ‘unsubscribe’ in the subject line.
Server logs: Retained for 90 days.
Access to the production database is restricted to:
Row-level security is enabled on all tables. Service role keys are stored as Supabase Edge Function secrets and are not exposed in code, logs, or responses.
You may request at any time:
Submit requests to mylavarapu8@gmail.com. Requests are processed within 14 business days.
The platform uses these third-party services:
No other third-party services receive customer data.
Material changes to this Data Handling statement will be notified by email to your account address with 30 days’ notice. The date at the top of this page reflects the most recent review.
Data handling questions: mylavarapu8@gmail.com. For legal questions about these Terms, see the Terms of Service.
GxP Governance Assessment Engine
Short version: The Engine collects only what’s needed to provide the assessment service and run the platform. Your data is stored in the US on Supabase (AWS us-east-1). It is not used to train models, shared with third parties for marketing, or sold. You can request deletion at any time.
Access request form submissions: Name, work email, organisation name, organisation type, job title, regulatory frameworks, use case description, system count estimate, current tooling, decision-maker status, referral source. Used to evaluate and process access requests.
API call data (assessment audit log): For each assessment API call, we record: organisation ID, API key identifier (prefix only — not the full key), system type requested, assessment category, regulatory frameworks requested, governance decision returned, templates applied, trust score, required actions count, call duration, status (completed / failed). This is the audit trail required for regulatory defensibility of the platform itself.
API credentials: API keys are hashed with SHA-256 before storage. The full key is shown once at provisioning and is not recoverable. The stored hash cannot be reversed to the original key.
Email subscriptions (Validation Futures): Email address and the article page from which you subscribed. Used only to send Validation Futures perspectives.
Website usage: Standard server logs (IP address, browser type, pages visited, timestamps). Not linked to assessment activity.
Primary database: Supabase (PostgreSQL), hosted on AWS us-east-1 (Northern Virginia, United States).
Email delivery: Resend, used only to transmit confirmation and notification emails. Resend does not retain email content beyond delivery.
Stripe: Payment processing. Stripe stores billing information under its own privacy policy. We store only the Stripe customer ID and subscription ID in our database.
No data is stored in the EU, UK, or any other jurisdiction. If your organisation’s data residency requirements require non-US storage, contact us before requesting access.
Data collected through the platform is used exclusively for:
Your data is not used to train machine learning models, improve assessment outputs for other customers, or derive competitive intelligence. Assessment outputs generated for your systems are not shared with any other organisation.
Access request records: Retained for the lifetime of the commercial relationship plus 3 years for record-keeping purposes.
Assessment audit log: Retained indefinitely. These records are part of the platform’s regulatory audit trail and cannot be selectively deleted without compromising audit integrity. On account termination, audit log records are anonymised (org ID and API key ID replaced with a non-reversible hash) rather than deleted.
API credentials (hashes): Retained until revoked. Revoked key hashes are retained for 1 year to detect and block replay attempts.
Email subscription records: Retained until unsubscribed plus 30 days. Unsubscribe by replying with ‘unsubscribe’ in the subject line.
Server logs: Retained for 90 days.
Access to the production database is restricted to:
Row-level security is enabled on all tables. Service role keys are stored as Supabase Edge Function secrets and are not exposed in code, logs, or responses.
You may request at any time:
Submit requests to mylavarapu8@gmail.com. Requests are processed within 14 business days.
The platform uses these third-party services:
No other third-party services receive customer data.
Material changes to this Data Handling statement will be notified by email to your account address with 30 days’ notice. The date at the top of this page reflects the most recent review.
Data handling questions: mylavarapu8@gmail.com. For legal questions about these Terms, see the Terms of Service.