Privacy & Security
PRISM is a project and portfolio assessment tool built by SETA-ED. If you use PRISM without signing in, your data stays in your browser and we never see it. If you create an account, your data is stored privately in a Supabase database in the United States, encrypted at rest, readable only by you. The only time data leaves that database is when you run an AI analysis on a proposal, in which case the proposal text is sent to Anthropic to be processed, and is not retained after the response.
What we store
If you use PRISM without signing in
- We store nothing on our servers about you or your assessments.
- All your data lives in your browser's
localStorage. Clearing your browser data deletes it. - The only network call PRISM makes on your behalf is to our AI analysis endpoint, when you choose to run one (see AI analysis below).
If you sign in with an account
- Your email address (used as your sign-in identity).
- A display name (defaulted to the part of your email before the @).
- An optional organization name and role, if you fill them in.
- Each venture you create: its name, your scores, evidence notes, flags, and risk plan items.
- Timestamps of when ventures were created and last updated.
- An audit record of AI analysis calls — used to investigate problems if you ever report one. (Sign-in and save audit logging is on our short list of follow-ups.)
We do not store:
- Passwords (PRISM uses magic-link sign-in — there is no password to store).
- Your IP address in raw form. We store a one-way hash of it for abuse prevention.
- Anything we don't list above.
Where the data lives, and who can see it
- Database: Supabase Postgres, hosted in the United States.
- Encryption: at rest (managed by Supabase) and in transit (HTTPS only).
- Access control: Postgres row-level security policies enforce that only your account can read your ventures. This isn't a promise we make in code our application can choose to ignore — it's enforced by the database itself.
The humans who can read your data:
- You. Through the PRISM interface or by exporting your data.
- If there's a problem you need diagnosed, you can give SETA-ED permission to read your data. Access is only granted with your explicit permission, and every instance is logged in our audit table.
- In the event of a database security incident, Supabase operations staff will be brought in to mitigate. This is a vendor reality of any hosted database. Supabase's privacy documentation is at supabase.com/privacy.
We do not share your data with third parties for marketing, analytics, or research. We do not have a sales team, advertisers, or partners with data access.
AI analysis: how it works
When you click "Run PRISM Analysis," the proposal text you've pasted is sent to Anthropic's API. Anthropic processes the text, returns scoring suggestions, and per Anthropic's commercial terms, does not use that text to train models and does not retain it after the response.
Specifics:
- The model we use is Claude (currently Haiku 4.5).
- We send only the proposal text and the rubric structure. We do not send your account email or any identifying information about who is running the analysis.
- We do not store the proposal text on our servers unless you save the venture afterward. If you save it, it joins the rest of your venture data per the section above.
- If you don't have an account, the analysis still works, and there is no record of the call tied to you.
If you'd prefer not to send proposal text to an external LLM at all, you can score the rubric manually inside PRISM, as the AI analysis feature is optional. We're considering an explicit "manual only" toggle; let us know if that matters to you.
Cookies and browser storage
- We use one authentication cookie (set by Supabase) to keep you signed in across page loads. It is removed when you sign out.
- We use
localStorageto remember your foundation branding preferences (name and logo) for branded report exports and, if you use PRISM without signing in, to store your ventures. - We do not use analytics cookies, tracking pixels, advertising cookies, or third-party trackers of any kind.
Deletion
- You can delete any venture from the PRISM interface at any time. Deletes are immediate in our active database.
- To delete your account and all associated data, email privacy@seta-ed.com. We commit to deleting from the active database within 7 days of your request, and from encrypted backups within 30 days (the backup retention window).
- Audit log entries may be retained for up to 90 days after account deletion for security incident investigation. They contain no venture content, only action types and timestamps.
Data export
You can export any venture's full content from the PRISM interface as Markdown or a branded PDF. We're adding a one-click "export everything" option in a future update. If you need a full export today, email us.
Changes to this page
When we change what's on this page, we'll update the "Last updated" date at the top, and for material changes we'll email signed-in users at least 14 days before the change takes effect. We will not retroactively change how previously-stored data is used.
Things we don't have (yet)
We believe in saying what's true now, including the gaps:
- EU data residency. PRISM data currently lives in the United States. If your organization needs EU residency, please get in touch — Supabase supports an EU region and we can stand up an EU instance.
- Single sign-on (SAML/SSO). Not yet supported. If your foundation requires SSO, get in touch.
How to contact us
- Privacy and security questions: privacy@seta-ed.com
- Anything else: hello@seta-ed.com