What we keep, and what we cannot
This page describes what the service does, not what we intend. Each line below is a fact about the code that is running.
Your account
| What | Kept as | Why |
|---|---|---|
| Your email address | As you typed it, lower-cased | It is the credential. There is no password. |
| Sign-in codes | A keyed digest, for ten minutes, deleted on use | The code itself is never stored. |
| Your session | A digest of one cookie, for thirty days | The cookie is HttpOnly; the page cannot read it. |
| API tokens | A digest, a name, when it was last used | A token is shown once. We cannot show it again. |
| A provider's key you lend us (OpenRouter, World Labs, TypeSafe) | Sealed, with its last four characters beside it. This is the one thing here that is not a digest: a key has to be used, so it cannot be one. | It is sealed under a secret that is not in the database, so the database alone is not a set of your credentials. We can use it and cannot show it - not to you either. Remove it on Integrations and it is deleted; to cancel the key itself, do that at the provider. |
| Calls made with those keys | When, which provider and host, what for, what kind of thing was sent, whether it was answered | So that you can read what was done in your name. Never the thing that was sent. |
| Requests for codes | A count per hour against a digest of the address and of the IP | To slow down guessing. It is a count, not a log. |
Your work
- In the browser, nothing leaves the tab. The worker that reads your files deletes its own network access before it accepts one. The account API on this site refuses any request over four kilobytes, so there is nowhere here to send a file.
- On the collector, what you post with the CLI: scenario names, scores, which faults each scenario caught, the build and suite names you chose. If you upload a recording, everything your adapter printed is stripped first - what is stored per run is its key, the fault injected, the outcome and the name of the check that failed.
- A project you push (
mutational project push, which says what it sends every time): the fault catalogue, what each scenario asserts with its source removed, the format a model may write in, and each sweep's full record if you switch that on. Field notes you file. Scenarios a model proposed, the campaigns asked of your workers, and any picture a world model painted. - Scenario source is never taken. The collector refuses it by name - and with it your adapter's command line, its environment, any path, and what a set-aside scenario printed.
- To a model, on your key: the scenario format and its examples, the fault catalogue's operators, and the worklist - to OpenRouter, to propose scenarios. The kinds of object in a scene, its container and whether a person is nearby - to World Labs, to paint it. A note's outcome and summary - to TypeSafe or OpenRouter, to file it. Nothing else, and every call is listed on your Integrations page.
Who else sees it
Cloudflare hosts the site, the database and the recordings. Resend delivers the sign-in email, so it sees your address and the code. If you lend us a provider's key, that provider sees the calls made with it, from our server, and nobody else does: a key is only ever sent to the provider it belongs to, and saving one asks that provider about it once. There are no analytics, no advertising and no pixels, and nothing on any page is loaded from anywhere but this site. The one library the pages use - GSAP, which moves the landing page's diagrams - is served from here too. One cookie is set, and only after you sign in.
Deleting it
Delete any sweep through the API and its recording is deleted with it. Delete your workspace from the dashboard and everything goes - recordings first, then every row, the keys you lent us and the record of calls made with them among them, then the account. Sweeps and deletion decisions older than 365 days are removed from free workspaces automatically, and with them what the loop left behind - campaigns, proposals, pictures - and the record of calls made with your keys.
Questions
Write to admin@mutational.in.