Trust and Security.

PUBLIC BETA

Current security posture

Monderman Workspace is currently in public beta. This page describes controls that are operating today and avoids claiming certifications or controls that Monderman has not completed.

Browser support. Controlled release checks currently cover current Chrome/Chromium and automated WebKit rendering for public pages, generated reports, HTML and JSON downloads, responsive layouts, and opening reports for printing or PDF export. Native Safari and browser-managed print dialogs remain beta and best-effort until dedicated native testing is complete.

ARCHITECTURE

How a Diagnostic moves from browser to saved result

The Monderman site is served as static pages over HTTPS. A free first Decision Velocity run can show a score and band before sign-in; an account is required to save and open its full report. Other direct Diagnostics require a signed-in member session. Directed campaign assignment links can be completed without the recipient becoming a Workspace member.

Diagnostics call a single API service on Render. Monderman calculates and saves scores using versioned application code and Supabase Postgres. When AI-assisted reporting is enabled, the server sends selected report evidence to Anthropic's commercial API for a separate written interpretation. The interpretation does not change the saved score. Service-role database credentials, Stripe secret keys, Anthropic credentials and email-provider credentials stay server-side and are not shipped to the browser.

Core outside services currently include Supabase for database and authentication, Render for the API, Anthropic for AI-assisted report interpretation when enabled, Resend for email delivery, Stripe for billing, Cloudflare for bot verification, GitHub for the static site repository and hosting workflow, and public content-delivery networks for versioned browser libraries.

TRANSPORT

Encrypted in transit

Browser traffic to the Monderman site, API and core hosted services uses HTTPS/TLS. Payment details are entered on Stripe-hosted payment systems rather than into Monderman's own application.

DATABASE ACCESS

Row-level security and server-side authorization

Monderman uses database row-level security and server-side authorization to restrict Workspace data access. Customer browser access uses Supabase's public publishable key plus the signed-in user's session. The publishable key is intentionally visible in browser code; it is not a service-role secret.

Policies and authorization helpers restrict signed-in users to the Workspace operations their role allows. Service-only tables can have RLS enabled with no customer policies, which means browser roles cannot read or write those rows. Privileged server operations use server-side credentials.

Client write privileges are also narrowed at the grant layer. Workspace administrators can change the Workspace name and review status through the customer interface, while plan, usage, billing and stored Diagnostic result fields remain server-managed.

AUTHENTICATION

Workspace pages require a valid session

Supabase Auth manages member sessions. Protected Workspace pages check for a valid session and redirect signed-out users to sign in. Authorization is then enforced again at the database or API boundary instead of trusting a hidden button or browser-only check.

Directed campaign recipients receive scoped assignment links. Those links authorize only the assigned Diagnostic flow and do not turn the recipient into a Workspace member.

IN-PROGRESS SESSIONS

Temporary state protects longer Diagnostics during a restart

While a Diagnostic is in progress, Monderman keeps temporary run state so a 30- or 60-minute Diagnostic can survive a service restart or deploy. The API keeps a local copy and a durable Supabase snapshot.

For all four Diagnostics, active run state has a four-hour cutoff. Restore logic ignores a session once it is older than that cutoff. The durable snapshot can remain until it is overwritten, so four hours is the active-use and restore boundary, not a promise of physical deletion from every stored snapshot at exactly four hours.

DIAGNOSTIC INTEGRITY

The server calculates and saves the score

The browser does not set the score for a saved Diagnostic. The API builds the scoring input, applies the versioned scoring logic, and saves the result. Directed assignments use the same server path rather than accepting a result calculated in the browser.

Optional written observations are stored and displayed separately and do not change the structured score. They are sent for AI interpretation only when that separate feature is enabled and the participant has recorded the required permission for those saved observations; the report states when they were not incorporated.

ANONYMITY

Anonymous responses remove the saved identity link

When a campaign is sent as anonymous, the completed Diagnostic run is not saved with a join back to the named recipient assignment. The person is told about the anonymity setting before responding.

Business unit and team can still be retained because they are part of the organizational analysis. In a small group, that context can make a person inferable. The customer Workspace has no direct completed-result-to-recipient join, although Monderman still processes necessary invitation, request, delivery, and security metadata. A specific anonymous result therefore ordinarily cannot be located later from the recipient identity alone.

AI PROCESSING

How AI-assisted reports and chat are processed

AI-assisted interpretation is currently enabled for eligible Diagnostic and Synthesis reports, including pilot reports. Optional written observations are used only when the participant has explicitly allowed the applicable processing. Earlier observations are not automatically made eligible. A saved report can show measured results before interpretation is ready; its status identifies whether interpretation is available. Restoring this service does not automatically regenerate or replace older saved reports.

Monderman does not use Customer responses, observations, reports, chat messages or organization history for model training, fine-tuning, provider feedback, shared benchmarks or cross-customer research, including in aggregated or de-identified form. Saved results remain available to authorized users within their own organization. External practice guidance comes from reviewed public or properly licensed sources.

The public assistant and Hans use Anthropic for conversational product guidance, separately from report interpretation. Their requests contain a limited recent conversation, approved public product information and, for Hans, the current page and server-checked plan and role. They do not have access to source code, scoring formulas, question banks, participant records or saved report contents. Hans requires verified sign-in and eligible membership in the selected organization. Do not paste report contents, personal information, credentials or confidential, classified or controlled information into either chat.

Chat requests and replies are screened for prohibited requests, unsupported claims and unsafe links. These checks reduce risk but do not guarantee every reply is correct or every attack will be detected. The assistants cannot change a score, send a campaign, modify records or buy a subscription. Monderman's chat application does not store transcripts in its database or intentionally log message contents; limited usage metadata supports spending controls. Chat content is subject to the same no-training policy and standard provider-retention exceptions described below and in the Privacy Notice.

When AI-assisted reporting is enabled, selected structured answers, computed results and context are sent to Anthropic's commercial API. Synthesis of your own saved runs can include selected original structured answers and their exact questions, with each run's Diagnostic, perspective, run length and questionnaire version. Campaign Synthesis can include descriptive answer distributions for each exact question and context, not named participants' individual answer records. Small or insufficiently supported groups are withheld. A bounded selection of permitted participant observations can also be included, with new per-run permission under the September 12 notice; an earlier permission does not authorize this expanded use. The same permitted evidence and proposed report text may be sent for request-size checks before drafting or review, even if no interpretation is generated. Monderman's diagnostic engine produces the scores, classifications, evidence limits and available action options. Claude supports research and writes the explanation from authorized evidence within those rules. Automated checks and a separate AI review screen the interpretation before release; they do not establish scientific validity or guarantee an outcome. A separate public-research process uses only predefined sector and Diagnostic categories, not customer answers, organization names or Workspace history. Reports show the research date or disclose that no newly checked research is included. Review the report before acting. Anthropic states that commercial-product inputs and outputs are not used to train its models by default unless the customer explicitly opts in or submits qualifying feedback.

Anthropic states that standard API inputs and outputs are automatically deleted from its backend within 30 days, subject to its documented usage-policy, legal, contractual, and customer-agreement exceptions. This is not a zero-retention arrangement. Monderman does not send Stripe card details or Monderman service credentials with Diagnostic interpretation requests.

TRIAL & BILLING BOUNDARIES

Deleting a Workspace does not reset trial eligibility

The 30-day Pattern beta trial is enforced by a durable one-time redemption record tied to the account identity and normalized email, not only to a Workspace. Deleting a Workspace therefore does not create another trial.

The trial has an independent database expiry boundary and a Stripe trial end/cancellation boundary. Delayed Stripe trial events are not allowed to restore Pattern access after the database has already expired the evaluation.

SECRETS

Privileged credentials stay on the server

The browser necessarily contains public configuration such as the Supabase project URL, publishable key and public bot-verification site key. Those values are not treated as secrets. Privileged database, payment, AI and email credentials stay on the server.

AI-backed API endpoints also apply request-size and rate limits to reduce automated abuse and unexpected model spend.

WHAT WE HAVE NOT DONE

Current certification boundary

Monderman does not currently claim SOC 2, ISO 27001, FedRAMP or another formal security certification, and does not represent that the public beta has completed an independent penetration test. We will not describe those controls as complete before they are complete.

If your organization has regulated-data, residency, contractual or formal assurance requirements, contact us before using Monderman for that data.

REPORTING

Security questions and responsible reporting

For a security questionnaire, architecture review, suspected vulnerability or security concern, use the Connect form or email connect@monderman.com.

See also: Privacy for what Monderman collects and why, Subprocessors for current providers, and Terms of Use for the rules of use.