You're sending us your product. Here's how we treat it.
A coverage scan or audit means handing your course files — your actual product — to a third party. That deserves more than a privacy-policy link. These are the standing rules, and where a rule is enforced by the engine's architecture rather than by promise, we say how.
Your materials are owner-scoped, structurally.
Everything ingested from your files is tagged to your owner identity at the moment it enters the system, and retrieval is scoped before any content is selected — not filtered afterward. Another client's audit cannot surface your content, because the engine never sees it as a candidate in the first place.
Never cross-client. Never benchmarks. Never marketing.
Your courses are analyzed against the published standard — not against other clients' courses. Nothing from your materials is used in another client's deliverable, an aggregate statistic, or our marketing. Any example we ever publish from a real engagement happens only with your written permission, and you see it first.
Never used to train models.
Your materials are inputs to your audit, and that's all. We don't train or fine-tune any model on client content, and our model vendors are configured not to either.
Deleted on request — fully.
Say the word and your source files, the ingested content derived from them, and the working artifacts of your audit are deleted. What you keep is what we produced for you: the evidence file and records we delivered.
The mechanical core runs offline.
The credit recompute, question-floor checks, and coverage map are deterministic arithmetic run against a local catalog of standard locators — that lane makes no external calls at all. Where AI assists (drafting prose around the findings), it works cite-or-refuse: it can only reference your materials and the catalog, and a human reviews the output before it reaches you.