This page is for whoever has to sign off on the tool. Below are five things you can run yourself in about ten minutes, and what each one should show. If any of them behaves differently than described, we have a problem and we want to hear about it.
We would rather hand you the tests than the assurances. Assurances are what every vendor brings.
Do this. Open the scan page with Private Mode on, then turn off your wi-fi. Drop in a file and run a scan.
You should see. It completes. Findings, scoring, the whole thing — with no network at all. Software that runs offline cannot be sending your data anywhere, and no certificate demonstrates that as directly.
Do this. Open your browser developer tools, switch to Network, and run a scan on a real file. Read every request.
You should see. No request carries the contents of your file. You will see requests for the page itself, for your sign-in status, and a scan counter.
The exception. With Private Mode off you will also see one request to our column-mapping service carrying your column header names — the text of the headers, never a row or a cell. That is the one thing that leaves, it is on this list because it does, and Private Mode stops it.
Do this. Run: curl -sI https://www.orgdrift.com/scan | grep -i content-security-policy — that URL redirects to the workspace, and the header is on the redirect too, so you get the policy either way.
You should see. The connect-src directive on our data pages permits our own origin and nothing else. That is a Content-Security-Policy — the browser enforces it, and we cannot override it at runtime. It means the page is not permitted to open a connection to any third party, whatever our code tries to do. You will also see script-src without unsafe-eval, and a two-year Strict-Transport-Security.
Do this. View source on any page that shows your data — the scan workspace, findings, the verification console — and search for "clarity".
You should see. Nothing. We use Microsoft Clarity for session replay on marketing pages, and it is not loaded on any page that can render employee records. Not a masked version. Not present.
Do this. Compare the list below against the origins you saw in test 2, and against the Content-Security-Policy from test 3.
You should see. Everything that receives anything is named below, with what it receives. If you find an outbound request to an origin that is not on this list, that is a bug and we want the report — there is a disclosure address in our SECURITY.md.
The complete list, including the ones that never touch customer data. One of them receives something derived from your file — Anthropic, and only your column header text. The rest handle your account, your messages to us, or nothing of yours at all.
| Service | What it receives | Category |
|---|---|---|
| Vercel | Hosting and edge delivery. Also provides aggregate page-view counts and page-load timing, which are not loaded on any page that can display your data. | Account / billing |
| Stripe | Payment processing. Receives your email and payment details when you buy something. Card numbers go directly to Stripe and never reach our servers. | Account / billing |
| Upstash | The small key-value store holding sign-in and entitlement state. Keys are a SHA-256 hash of your email address; the values are counters and access flags. No file data. | Account / billing |
| Anthropic | Column-mapping suggestions. Receives the column header names from your file, the source-system role you selected, and our target schema. Receives no rows, no cell values and no employee records. Turn on Private Mode and it is not called at all. | Derived from your file |
| Resend | Transactional email delivery — sign-in links, and any message you send through a form on the site. | Contact details |
| Microsoft Clarity | Product-quality session replay, on our marketing pages only. It is not loaded on the scan workspace, the verification console, findings, remediation or governance surfaces — not a masked copy, none. You can confirm that in view-source. | No customer data |
| Notion | Where a message you send through a contact or application form is recorded, so we have a history of the conversation. Your name, email, company and what you wrote. Never scan data. | Contact details |
| Calendar and email for how we run the company. Receives no customer data from the product. | No customer data | |
| GitHub | Source control and continuous integration for our own code. Receives no customer data. | No customer data |
No SOC 2 report yet. It is on the roadmap and we are building toward it. We would rather you learn that here than three weeks into a questionnaire. The architecture was deliberately built so the audit scope stays small — there is no customer-data environment to audit, because we never take custody of your data — but that is an argument, and we know it is not a certificate.
No third-party penetration test yet. When we have one, the letter will be available here.
We are a small team. That is why the tests above matter more than our headcount: they do not depend on trusting our process, only on what your own browser can show you.
If your review needs something not on this page — a completed CAIQ or SIG, a call with whoever wrote the code, a walkthrough of the data flow — ask. Those are all things we do.