From submission to report, end to end.
No black box. The pipeline behind the score is described here in plain language and in the same level of detail a careful reviewer would want before defending a decision.
What happens between submit and report.
- 01EdgeSubmission lands at the edge
Cloudflare Workers serves the app. Per-IP and per-account rate limits sit on scan endpoints before detection runs.
- 02ValidationThe route validates the request
Bad input fails fast with typed errors for modality, file format, file size, text length, credits, and plan access.
- 03ConsentCross-border processing consent
First scan in a session triggers the disclosure modal. The consent is logged with the timestamp and is reversible.
- 04DetectionDetection runs server-side
Text submissions run through a calibrated language-pattern model. Image, video, and audio run through a multi-signal media analyzer. Vendor names are normalized internally.
- 05CalibrationConfidence variance is reported
The same input is resampled across slightly perturbed prompts; the variance is the confidence band shipped with the score.
- 06ReportReport renders in the dashboard
Score, signals, sentence highlights, and the notes pane. PDF export and public share are opt-in per scan.
- 07PersistenceSaved privately; you control sharing
Your reports save privately to your dashboard (score, signals, modality, timestamp, scan id, and the content you scanned) so you can reopen them. Private unless you share.
- 08AuditAudit log entries write append-only
Credit-consuming, billing-impacting, and auth-impacting events write to an append-only audit log scoped to your account.
- 09ObservabilityObservability tunneled first-party
Errors and performance traces tunnel through a first-party subdomain. PII is scrubbed before any payload leaves our environment.
What’s actually crossing the wire
Submissions cross the network only between your browser, our edge, and our processor environments. Customer-facing pages avoid third-party widgets; subprocessors for authentication, billing, detection, email, and observability are documented in the privacy policy.
What we do not do
- We don’t train detection models on your submissions. The calibration plate is updated on internal benchmark data, not on user inputs.
- We don’t expose vendor names. Detection signal labels are vendor-agnostic by design, if we change processors, the labels don’t.
- We don’t delete your scans automatically. They save privately to your dashboard by default, so you can reopen them, and they stay private unless you create a share link.
Where to read more
See /accuracy-and-limitations for the calibration posture, /false-positives for the working protocol when human writing flags, and /privacy-and-retention for the data flow and subprocessor list.