Security summary
For IT and information security teams.
What Operational Mind does with data, written from the code rather than the brochure. Last reviewed 24 September 2026. Operated by Adam Carruth in the United Kingdom.
In short
Documents used in the chat are read on the user's own computer and the file is never uploaded. Their text is sent, with each question, to Anthropic's Claude API to produce the answer, and Operational Mind stores none of it. PM Command Centre data lives in the user's browser and leaves it only if they switch on cloud sync. Pasted meeting notes go to Anthropic for extraction and are not stored by us. Anthropic does not train on this content and deletes it within 30 days. Whether an employee may send your documents to a third-party AI service is your policy's call; this page is here so it can be made on facts.
Data flow
| Data | Where it lives | What leaves the device | What we keep |
|---|---|---|---|
| Documents used in the chat (PDF, Word, Excel, PowerPoint, text) | Read in the user's browser. The file is never uploaded. | The extracted text and the file name, sent through our server to Anthropic with each question. | Nothing. Not stored or logged, and not saved in the browser either: gone when the tab is closed or reloaded. |
| Chat questions and answers | The open browser tab. | Sent through our server to Anthropic with each question. | Nothing. |
| Pasted meeting notes (extraction and meeting report) | The user's browser. | The pasted text and today's date only, through our server to Anthropic. Existing project data is not sent. | Nothing. The structured result goes back to the browser. |
| PM Command Centre projects (registers, budgets, schedules, decisions) | The browser's local storage on the user's own device. | Nothing, unless the user switches on cloud sync (off by default). | Only with sync on: one database row per account, encrypted in transit and at rest. |
| Exports (PowerPoint, Excel, backup file) | Generated in the browser and saved to the user's device. | Nothing. | Nothing. |
| Account | Clerk (sign-in provider). | Name and email address, held by Clerk. | Membership role, access expiry date, and usage counts (numbers only: messages, uploads, extractions). |
| Payment | Stripe. | Card details go to Stripe only. | Nothing. We never see card details. |
Sub-processors
| Provider | Role | Data it handles |
|---|---|---|
| Anthropic | AI model (Claude Sonnet 4.6, via the API) | Document text and file names, questions, answers, pasted notes |
| Vercel | Hosting and server functions; anonymous page-view analytics | Requests in transit; short-lived logs that never contain document names or content |
| Clerk | Sign-in and accounts | Name, email address, role, expiry, usage counts |
| Neon | Postgres database | Synced PM data (only if the user turns sync on); anonymous visit counts |
| Stripe | Payments | Billing and card details |
| Google (Gmail) | Account and notification emails | Email address; details entered in the beta request and feedback forms |
Where processing happens
- Server code runs in Vercel's Washington, D.C. region, in the USA. Pages are served from Vercel's edge network, which for UK users means London.
- Anthropic, Clerk, Neon and Vercel are US companies. Data sent to the service therefore leaves the UK. There is no choice of processing region.
What is retained, and for how long
- Our servers store no document, note, question or answer. Hosting logs record events such as a payment processed or a request that failed. They can include an email address, never a document name or any content.
- Anthropic deletes API inputs and outputs within 30 days. It may keep them for up to two years if a request is flagged under its usage policy, or longer where the law requires. There is no zero-data-retention agreement in place.
- Anthropic's commercial terms bar it from training models on this content.
- Chat requests use Anthropic's prompt cache, which holds the prompt, including any document text, for about five minutes after the last question so follow-up questions cost less.
- Synced PM data is kept until the user deletes the cloud copy or the account is deleted. The database provider may hold it in short-term backups for a limited period after that.
- PM data on the device stays there until the user deletes it or clears the browser. The app adds no encryption of its own beyond the device's protections.
- Visit counts are anonymous: an event name, a time and where the visit came from (for example LinkedIn). No cookie, no IP address, nothing that identifies a person.
Deletion
- Chat: close or reload the tab. There is nothing to delete on our side.
- A PM project: delete it in the app. With sync on, the deletion is carried to the cloud copy.
- The cloud copy: one click in the app ("Delete cloud copy") removes the database row immediately, provider backups aside.
- The account: email adamcarruth84@outlook.com from the registered address and the account and any synced data are deleted by hand. Deleting an account does not yet remove its synced copy automatically, so delete the cloud copy first or ask.
Access controls
- All traffic is over HTTPS. Sign-in is handled by Clerk; the app never handles passwords. Two-step verification (2FA) is switched on, so any account can add a second sign-in factor.
- Every route that reads or changes account or project data checks the signed-in account, and the PM and chat features also check the user's membership and its expiry date. The only public routes are the beta request form and the anonymous visit counter (both rate-limited), the payment webhook (verified by Stripe's signature) and a daily scheduled job (protected by a secret).
- Every query against synced data is keyed to the caller's own account, so one account cannot read another's.
- Synced data is encrypted in transit and at rest, but not end-to-end: the operator could technically read the database, and only the operator has that access. The operator's admin view shows account email addresses, membership and usage counts, never project data or documents.
- Pages send clickjacking protection (frame-ancestors and X-Frame-Options), nosniff, a strict referrer policy, and block camera, microphone and location access. There is no full Content-Security-Policy yet.
- PDFs are read with script evaluation switched off, the recommended defence against CVE-2024-4367.
What is not in place
- No organisation accounts, admin console, single sign-on or customer-facing audit log. Each account belongs to one individual.
- No zero-data-retention agreement with Anthropic, and no UK or EU processing option.
- No 24-hour support. Security questions and incidents go to the email address below.
Security questions, incident reports or a request for more detail: adamcarruth84@outlook.com. The full privacy policy covers the same ground for individual users.