Current hosting
Sites hosting on Cloudflare Workers, with D1 for optional authenticated saved cases. This is not an AWS GovCloud deployment. Hosting infrastructure alone does not establish authorization.
SECURITY APPROACH
Know where the data goes.
Know who decides.
The current hosted evaluation processes fictional inputs using a deterministic engine. It does not connect to your AWS account, change infrastructure or authorize a system.
Request the technical briefThe actual data flow.
1 / Your browser
Scenario or synthetic JSON input
2 / Hosted API
Input validation and deterministic analysis
3 / Your browser
Results, local notes and downloaded evidence pack
Boundary crossing: running analysis sends input to the hosted service. Anonymous use is not browser-only processing.
Optional branch: authenticated Save private case → owner-scoped D1 record. Save on this device uses browser localStorage; downloads are generated in the browser.
Where AI is—and is not—used
No language model generates impact results or evidence summaries. Supplied dependencies and deterministic rules drive the assessment. Higgsfield-generated conceptual motion is used for website storytelling; it is not operational telemetry or the analysis engine.
Read-only integration scope
The release normalizes supplied synthetic AWS Config JSON. It has no account credentials, live collector or CloudTrail ingestion. Read-only production collection is a proposed approach requiring separate implementation and permission review.
Control and authorization context
The model links supplied NIST SP 800-53 control and authorization records. The network example compares SC-7 evidence. AC-4 is not mapped in that example and must not be inferred from its graph. The product does not assess control effectiveness. Your organization decides whether a change is significant, whether authorization documentation needs updating and whether a validated finding belongs in a POA&M.
Evidence provenance
SHA-256 hashes cover named input and evidence objects. Comparing with a trusted copy can reveal changed bytes. Hashes do not establish authenticity, correctness or compliance.
Access and local notes
Anonymous users can analyze, download and explicitly save locally. Local review notes, proposed contacts and action statuses are unverified and do not authenticate a reviewer. They never modify the engine’s evidence flags. Existing server cases retain authentication and ownership checks. Enterprise SSO and team RBAC are not implemented.
Evidence quality is separate from impact priority.
The engine flags missing per-system owners and authorization records, missing before/after evidence, snapshot-scope mismatches, and gaps on the selected shortest path. Optional relationship evidence includes a source reference, observation timestamp and supplied/disputed status. A 30-day freshness check is relative to the change timestamp, not the current date or a federal mandate. References are not fetched or authenticated. Local reviewer challenges never suppress the original flags.
Deployment requirements to discuss.
Customer VPC, AWS GovCloud and air-gapped operation may be requirements for your organization. None is an available deployment package today. Each requires engineering, security assessment, operational planning and explicit acceptance before it can be offered.
Security acceptance still required.
No FedRAMP authorization, agency ATO, independent security certification or completed customer pilot is claimed. Production assessment, monitoring, backup/restore, retention, deletion and support obligations remain to be agreed and verified.
JSON validation, size limits, same-origin write checks, case ownership checks and a restrictive workspace content security policy are implemented. They do not substitute for independent assessment.
Read the privacy and storage notice ↗