What we hold
Privacy
Every statement on this page describes what the code actually does, and is corrected if the code changes. Nothing here is aspiration.
What we store
If you create an account: your organisation's name, the email addresses and roles of its members, and the compliance records you choose to keep, including determinations, evidence files, transitions, watches, orders and questionnaire answers. Sign in uses an account key; only a hash of it is stored, so a copy of the database does not contain working credentials. Sessions are a random value in an HttpOnly cookie, stored server side as a hash.
What we count
Page views, as a number per page per day. No cookies for this, no IP addresses, no identifiers, no fingerprinting, and no third party analytics or advertising scripts anywhere on the site.
What leaves this site, and where to
Three things, each only when you use the feature that needs it. Party names you screen are sent to the U.S. Government's Consolidated Screening List API at trade.gov, because that is where screening comes from. Alert messages you configure are sent to the webhook address you provided. Regulation text and Federal Register data are fetched from public government sources by the server, which involves no data about you. Nothing else is sent anywhere, and nothing is ever sold, rented, or shared for advertising.
Where it lives
On Cloudflare's infrastructure: the database in D1, evidence files and nightly backups in R2, under the operator's account. Cloudflare is the hosting processor and does not get to use your content.
Supplier questionnaire replies
If a supplier answers a questionnaire you sent, their name, email and answers are stored in your account as your record, attributed to them, and shown to them as such before they submit.
Deletion
Ask, and your account and everything in it is deleted. Live data goes immediately. Dated backup snapshots age out within ninety days, enforced by the backup job itself. Public reference pages hold no customer data at all.
What we never do
No selling data. No advertising. No trackers. No reading your records for any purpose except serving them back to you, keeping backups, and fixing faults. No training AI models on your content.
In force from 27 August 2026. Changes are announced on this page with the date.