How the assessment protects privacy and security

The short version

• Your answers stay in your browser. They are never sent to, or stored by, this site's operator.
• Nothing is saved unless you save it. Closing the tab, refreshing, logging out, or 30 minutes of inactivity clears everything.
• Files you download are yours to protect. PDFs and assessment files are created on your computer and may contain protected health information (ePHI).
• No analytics, no tracking, no ads.

What happens to your answers

The assessment runs entirely inside your browser tab. When you answer questions and see recommendations, all of that computing happens on your own computer. The recommendation engine, vendor catalog, and pricing data are downloaded to your browser when the page loads; your answers never travel in the other direction.

This isn't just a policy — the tool is built so it can't send answers out. The page's security settings (its Content-Security-Policy) block every outbound network connection, and the app uses no browser storage. If you're technical, you can verify this in your browser's developer tools: the network tab stays silent while you work.

Signing in

The assessment sits behind Cloudflare Access. Approved assessors enter their email address and receive a one-time code — there is no password. Signing in records your email address and the time you signed in; that's what "protected" means here. Your assessment answers are never part of the sign-in traffic.

After sign-in, Cloudflare sets one strictly necessary cookie (CF_Authorization) that proves to the server you're allowed in. It is not used for analytics or tracking, and it never contains assessment data.

Files you create

Two kinds of files can leave the tool, and both are generated locally on your computer:

• PDF reports and vendor packets — created in your browser for printing or sharing with a vendor through your agency's approved secure workflow.
• Assessment files — a save file you can reopen later to continue an assessment. By default these are encrypted with a phrase you choose (AES-256; the phrase is never stored anywhere, so a lost phrase means a lost file). You can also download an unencrypted copy, but the tool asks you to confirm you'll store it on an approved, encrypted device.

Once a file is on your computer, it is outside the tool's protection. Treat any export as if it contains ePHI: store and send it only the way your agency's policies allow.

Automatic cleanup

Unsaved work exists only in the memory of your browser tab. The tool clears it when you close or refresh the tab, when you log out, and after 30 minutes of inactivity (with a two-minute warning first). If you need to pause a long assessment, save an encrypted assessment file and reopen it later.

Use an appropriate device

Because everything happens on your computer, your computer matters. Use the assessment only on an agency-approved, properly secured work device — not a shared, public, or personal device that your agency hasn't approved for ePHI.