Trust & Security Center

Access and accounts

Access follows your role and assignment

Monderman Workspace is available by invitation. Direct Diagnostics require a signed-in member with active Workspace access. New organizations need a valid invitation to activate their evaluation. Directed campaign links authorize only the assigned Diagnostic and do not make the recipient a Workspace member.

Supabase Auth manages member sessions. Protected Workspace pages redirect signed-out users to sign in. The database or API then checks what the signed-in user is allowed to do; access does not depend on hiding buttons in the browser.

Monderman uses database row-level security and server-side authorization to restrict Workspace data access. Database policies and permissions limit users to the operations their role allows. Tables reserved for server use can have row-level security enabled with no customer policies, so browser roles cannot read or write those rows.

Workspace administrators can change the Workspace name and review status through the customer interface. Plan, usage, billing and stored Diagnostic result fields remain server-managed, with browser write permissions restricted at the database level.

Public configuration is not a secret. Browser code includes the Supabase project URL, public publishable key and public bot-verification site key. Customer database access also requires the signed-in user's session. Privileged database, payment, AI and email credentials stay on the server and are not shipped to the browser.

Answers and saved results

How answers become a saved result

The public site is served as static pages. Diagnostics call a single API service on Render. Monderman's server builds the scoring input, applies versioned scoring logic and saves the result in Supabase Postgres. The browser does not set the saved score, and directed assignments use the same server process.

Optional written observations are stored and displayed separately and do not change the structured score. They are sent for AI interpretation only when that separate feature is enabled and the participant has recorded the required permission for those saved observations; the report states when they were not incorporated.

Encrypted in transit. Browser traffic to the Monderman site, API and core hosted services uses HTTPS/TLS. Payment details are entered on Stripe-hosted payment systems rather than into Monderman's own application.

The provider inventory below explains what information each outside service receives and links to its security documentation.

AI-assisted reports

What AI receives and what it can do

AI-assisted interpretation is currently enabled for eligible Diagnostic and Synthesis reports, including evaluation reports. A saved report can show measured results before interpretation is ready; its status identifies whether interpretation is available. Restoring this service does not automatically regenerate or replace older saved reports.

Scores and explanations have different jobs. Monderman's diagnostic engine produces the scores, classifications, evidence limits and available action options. Anthropic's AI supports research and writes the explanation from authorized evidence within those rules. The interpretation does not change the saved score. Automated checks and a separate AI review screen the interpretation before release; they do not establish scientific validity or guarantee an outcome. Review the report before acting.

Individual reports and your own saved runs. Selected structured answers, computed results and context are sent to Anthropic's commercial API. Synthesis of your own saved runs can include selected original structured answers and their exact questions, with each run's Diagnostic, perspective, run length and question-set version.

Campaign evidence. Campaign Synthesis can include descriptive answer distributions for each exact question and context, not named participants' individual answer records. Small or insufficiently supported groups are withheld.

Written observations require permission. A bounded selection of permitted participant observations can be included only with new per-run permission under the September 12 notice for those saved observations. Earlier permission does not authorize this expanded use. Earlier observations are not automatically made eligible.

Processing before a report is written. The same permitted evidence and proposed report text may be sent for request-size checks before drafting or review, even if no interpretation is generated. Monderman does not send Stripe card details or Monderman service credentials with Diagnostic interpretation requests.

No training or cross-customer research. Monderman does not use Customer responses, observations, reports, chat messages or organization history for model training, fine-tuning, provider feedback, shared benchmarks or cross-customer research, including in aggregated or de-identified form. Saved results remain available to authorized users within their own organization. External practice guidance comes from reviewed public or properly licensed sources.

A separate public-research process uses only predefined sector and Diagnostic categories, not customer answers, organization names or Workspace history. Reports show the research date or disclose that no newly checked research is included. Anthropic states that commercial-product inputs and outputs are not used to train its models by default unless the customer explicitly opts in or submits qualifying feedback. Outside processing still occurs; see provider retention below.

Product-guidance chat

Guidance without access to saved reports

The public assistant and Hans use Anthropic for conversational product guidance, separately from report interpretation. Their requests contain submitted messages, limited recent replies, approved public product information and, for Hans, the current page and server-checked plan and role. They do not automatically retrieve source code, scoring formulas, question banks, participant records or saved report contents. Hans requires verified sign-in and eligible membership in the selected organization. Do not paste report contents, personal information, credentials or confidential, classified or controlled information into either chat.

Chat requests and replies are screened for prohibited requests, unsupported claims and unsafe links. These checks reduce risk but do not guarantee every reply is correct or every attack will be detected. The assistants cannot change a score, send a campaign, modify records or buy a subscription.

Monderman's chat application does not store transcripts in its database or intentionally log message contents; limited usage metadata supports spending controls. AI-backed API endpoints also apply request-size and rate limits to reduce automated abuse and unexpected model spend. Chat content is subject to the same no-training policy and standard provider-retention exceptions described in this center and in the Privacy Notice.

Privacy and retention

What is retained and what anonymity protects

Anonymous campaign responses

When a campaign is sent as anonymous, the completed Diagnostic run is not saved with a direct link back to the named recipient assignment. The person is told about the anonymity setting before responding.

Business unit and team can still be retained for organizational analysis. In a small group, that context may make a person identifiable. Monderman still processes necessary invitation, request, delivery and security metadata, but the customer Workspace has no direct link between the completed result and the recipient. A specific anonymous result therefore ordinarily cannot be located later from the recipient identity alone.

Temporary run recovery

While a Diagnostic is in progress, Monderman keeps temporary run state so a 30- or 60-minute Diagnostic can survive a service restart or deploy. The API keeps a local copy and a durable Supabase snapshot.

For all four Diagnostics, active run state has a four-hour cutoff. Restore logic ignores a session once it is older than that cutoff. The durable snapshot can remain until it is overwritten, so four hours is the active-use and restore boundary, not a promise of physical deletion from every stored snapshot at exactly four hours.

Provider retention and deletion

Anthropic states that standard API inputs and outputs are automatically deleted from its backend within 30 days, subject to its documented usage-policy, legal, contractual, and customer-agreement exceptions. This is not a zero-retention arrangement. The Privacy Notice explains Monderman's wider retention and deletion practices, and its optional measurement section explains that separate choice.

Evaluation and billing records

The 60-day free evaluation requires a valid invitation. A durable redemption record links activation to the account identity and normalized email, not only to a Workspace. Deleting a Workspace does not create another evaluation.

The database and Stripe each enforce the evaluation end. A delayed Stripe update cannot restore Pattern access after the database marks the evaluation as expired.

Providers and infrastructure

Outside services and the information they receive

Each provider is responsible for its service's security. Monderman is responsible for how those services are configured and used in the product. These links describe providers' own safeguards; they do not certify Monderman.

Provider inventory: September 12, 2026. Security references checked: September 24, 2026.

This inventory describes current providers, not a separate contract. It does not establish a particular data-processing agreement, certification, transfer mechanism, retention period or data-residency commitment. Organizational data-processing terms may be made available where required for an engagement.

Public-site and browser infrastructure

Render hosts and delivers the public static site. GitHub provides the source repository and deployment workflows. jsDelivr and cdnjs deliver versioned browser libraries. Public-site hosting and browser-library providers ordinarily receive request metadata such as an IP address and user agent. Monderman does not intentionally send Diagnostic answers to browser-library providers for content processing.

Specific provider-security roles

The linked provider references identify Cloudflare for content-delivery-layer protection against distributed denial-of-service attacks for Supabase, DDoS protection for Render's hosted applications and websites, and a web application firewall for Resend. These specific roles do not make Cloudflare responsible for every part of a provider's security.

Monderman will update this inventory when the providers used by the product materially change. Any engagement-specific notice or objection procedure will be stated in the applicable signed organizational data-processing terms.

Device protection and assurance

Where protection applies

Monderman uses CrowdStrike Falcon Go to protect the administrative devices used to operate the business. This protection applies to those devices. The website, application servers and databases are hosted separately and are not covered by this device subscription.

Monderman does not currently claim SOC 2, ISO 27001, FedRAMP or another formal security certification, and does not represent that Monderman has completed an independent penetration test.

If your organization has regulated-data, residency, contractual or formal assurance requirements, contact us before using Monderman for that data.

Browser support. Controlled release checks currently cover current Chrome/Chromium and automated WebKit rendering for public pages, generated reports, HTML and JSON downloads, responsive layouts, and opening reports for printing or PDF export. Native Safari and browser-managed print dialogs remain best-effort until dedicated native testing is complete.

Documents and contact

Find the detail or ask a question

• Privacy Notice: information collected, purposes, retention, deletion and privacy choices.
• Terms of Use: permitted uses, responsibilities and the terms governing the service.
• Methodology and sources: how the Diagnostics work and the limits of their evidence.
• Diagnostic and AI architecture: the distinction between repeatable scoring and AI explanation.

For a security assessment, architecture review, suspected vulnerability, privacy question or security concern, use the Connect form or email connect@monderman.com.