Privacy principles

Assessment data is among the most sensitive information an organization holds: what it does, what it depends on, and where it is exposed. SafetyLens treats that data as toxic waste and handles it accordingly. This page states the principles the application is built on; detailed final copy is being prepared.

Collect as little as possible: The assessment asks only what the analysis needs. It never asks for passwords, MFA secrets, private encryption keys, or recovery codes, and evidence fields warn against entering credentials or secrets.
Your data stays in your organization: Each organization's assessments are isolated from every other organization's, enforced by server-side authorization and covered by automated tests.
Secure accounts: Passwords are stored only as modern salted hashes, sessions are secure and expire, and account features include rate limiting and a safe reset flow.
Encrypted transport, protected storage: All traffic uses HTTPS in production, and the data model is designed so sensitive fields can be encrypted at rest.
Logs that respect the data: Assessment answers and evidence never appear in application logs; tokens, cookies, and authorization headers are redacted.
No invasive analytics: No third-party trackers. If usage analytics are ever added, they will be privacy-preserving and optional.
Assessment first, always: The core assessment never sends assessment data to an external AI service; scoring and recommendations run deterministically from application data.

This tool supports structured digital-security risk assessment and planning. It does not guarantee that all vulnerabilities or threats have been identified and is not a substitute for expert technical investigation when such investigation is needed.