What we keep, and what we cannot
This page describes what the service does, not what we intend. Each line below is a fact about the code that is running.
Your account
| What | Kept as | Why |
|---|---|---|
| Your email address | As you typed it, lower-cased | It is the credential. There is no password. |
| Sign-in codes | A keyed digest, for ten minutes, deleted on use | The code itself is never stored. |
| Your session | A digest of one cookie, for thirty days | The cookie is HttpOnly; the page cannot read it. |
| API tokens | A digest, a name, when it was last used | A token is shown once. We cannot show it again. |
| Requests for codes | A count per hour against a digest of the address and of the IP | To slow down guessing. It is a count, not a log. |
Your work
- In the browser, nothing leaves the tab. The worker that reads your files deletes its own network access before it accepts one. The account API on this site refuses any request over four kilobytes, so there is nowhere here to send a file.
- On the collector, what you post with the CLI: scenario names, scores, which faults each scenario caught, the build and suite names you chose, and - if you name a catalogue - each gated hazard's name and which scenarios stand behind it. If you upload a recording, everything your adapter printed is stripped first - what is stored per run is its key, the fault injected, the outcome and the name of the check that failed.
- A project you push (
mutational project push, which says what it sends every time): the fault catalogue, what each scenario asserts with its source removed, and each sweep's full record if you switch that on. Field notes you file, and the campaigns asked of your workers. - Scenario source is never taken. The collector refuses it by name - and with it your adapter's command line, its environment, any path, and what a set-aside scenario printed.
Who else sees it
Cloudflare hosts the site, the database and the recordings. Resend delivers the sign-in email, so it sees your address and the code. We hold no model key of yours and call no model on your behalf. There are no analytics, no advertising and no pixels, and nothing on any page is loaded from anywhere but this site. The one library the pages use - GSAP, which moves the landing page's diagrams - is served from here too. One cookie is set, and only after you sign in.
Deleting it
Delete any sweep through the API and its recording is deleted with it. Delete your workspace from the dashboard and everything goes - recordings first, then every row, then the account. Sweeps and deletion decisions older than 365 days are removed from Open workspaces automatically, and with them old campaigns.
Questions
Write to admin@mutational.in.