Security and data protection

1. Architecture principles

• Private data behind a server gateway. The browser never talks to the database. Form submissions are validated on the server and written with server-only credentials; row-level security is enabled with no public policies.
• No secrets in the client. Service credentials live only in server environment variables. Public pages contain no keys.
• Deterministic authority. For managed commercial integrations, feasibility truth, price validity, approval authority, funds-cleared state and supplier award are decided by deterministic services with evidence — never by a language model alone.
• Idempotent, auditable mutations. Every enabled commit action carries an idempotency key, principal and agent identity, brief/quote hash and correlation ID.
• Separation of public and private data. Supplier identities and buy rates are never exposed through the public surface.

2. Research participants

• Projects follow the ICC/ESOMAR International Code and applicable national and sector rules.
• Informed consent for participation, recording and any AI processing; disclosure of AI use where relevant.
• Direct identifiers are segregated from analysis data and from anything an LLM-accessible system receives.
• Data minimisation, defined purpose and retention, controlled cross-border transfers, protected recordings and special-category data.
• Physician and patient research adds credential verification, fair-market-value incentives, adverse-event routing and mandatory human compliance review.

3. Hosting and operations

The production website is hosted on Vercel with TLS and restrictive security headers. When database intake is enabled, request data is stored in a private Supabase Postgres project selected for the EU. If intake storage is unavailable, the form clearly says that nothing was saved and keeps the entered details available for retry. Access to operational systems is limited to authorised accounts.

4. Suppliers

Suppliers are assessed on data-protection agreements and transfer mechanisms, security posture, respondent identity controls and, for healthcare, credential handling. Supplier performance — including fraud and duplicate rates — feeds routing decisions.

5. Reporting a concern

To report a vulnerability or data-protection concern, use the contact form linked in the sidebar and include “Security” at the start of the message. We acknowledge reports within two business days.

Formal certifications (e.g. ISO 27001) are not claimed on this page. Statements describe design principles and operating practice and will be updated as controls are audited.