About
The technical posture in plain terms — what runs where, what a diagnostic stores, and who can read it.
ARCHITECTURE
The Monderman site is static pages served over HTTPS. Diagnostics run against a single API service, which scores responses, builds the narrative through Anthropic’s API, and stores results in a managed Postgres database (Supabase). Scoring, narrative generation, and every write of a diagnostic result happen server-side: the API holds service-role credentials that the browser never sees, and no scoring logic or sector calibration is exposed to the client.
Once you are signed in, the workspace reads and updates your organization’s own records — saved runs, action plans, notes, campaign tracking — directly against the database using a public, publishable key that carries no privileges of its own. Every table it touches is governed by row-level security, so that key can only ever reach rows belonging to the organization you are signed in to. Authorization is enforced by the database itself rather than by the browser.
TRANSPORT
All traffic between your browser, the Monderman site, and the Monderman API is encrypted over HTTPS/TLS.
STORAGE
A run stores the responses you provide and the derived result — scores, exposure figures, and narrative text. Runs are keyed to your organization’s workspace.
In-flight session state is held server-side and expires on a fixed schedule; completed results persist in your workspace until deleted.
ACCESS
Two credentials reach the database, and they are not equivalent. The API service holds a service-role credential, kept server-side and never sent to a browser; it performs scoring, result persistence, and administrative operations such as sending a campaign. The signed-in workspace holds only a public, publishable key, which grants nothing on its own.
Row-level security is enabled on every table and is the boundary that matters: each policy tests the signed-in user’s organization membership before a row is returned or changed. Workspace results are visible to your organization’s signed-in users and to no other tenant, and roles within your organization — participant, analyst, admin — govern what each person can see and do.
Diagnostics sent to named recipients use single-use links. The link itself is the credential: a recipient completes the assigned diagnostic without an account, sees their own result only if the sending admin chose to show it, and gains no access to your workspace.
REVIEW
Running a formal review? We’ll answer written security questionnaires and walk your team through the architecture directly — start here.
See also: Privacy — what we collect and why.