Data flow
The precise version of "your data stays in your network."
The three stages
1. Scoring — local. Submitted text is scored against the lexicon and feature model baked into the container image. No network call.
2. Simulation — local. A seedable Monte Carlo run over persisted latent state produces percentile vectors for Low, Medium, and High trajectories. Reproducible, and no network call. The design choice here matters: the percentiles come from a real distribution computed locally, not from a language model narrating a guess at one.
3. Rendering — optional, external. One LLM call converts the already-computed vectors into natural-language text in the subject's voice, plus one scenario-extraction call the first time a behaviour scenario is set.
Only stage three can leave your network, and only if you enable it.
With rendering off
Leave OPENAI_API_KEY out of the application secret.
The engine returns the same structured output — trust, cooperation, and defensiveness figures, the recommended next step, and the reasoning — through a templated renderer instead of prose. The response carries a note saying rendering is unavailable.
Zero third-party egress. Every stage of analysis runs in your cluster.
With rendering on
The prompt built from the latent vectors and subject model is sent to api.openai.com under your own API key, on your own account.
Three consequences worth stating plainly to a reviewer:
- Presponsieve is not in that path and never sees the request.
- Your data processing agreement for it is with OpenAI, not with us.
- The content sent is derived from analysis of the subject's text. Review a rendered prompt before enabling this in a regulated environment.
Audio
TRANSCRIPTION_BACKEND: "gcp" is a separate egress path, off by default. Staged audio is read from your own bucket and sent to Google Cloud Speech-to-Text for transcription with speaker diarization.
Left disabled, the audio endpoint declines and points users at text upload.
What is stored
| Data | Where | Encrypted |
|---|---|---|
| Submitted text and analysis results | Your PostgreSQL | Yes, sensitive columns |
| Latent simulation state | Your PostgreSQL | Yes |
| Report artifacts, PDFs, radar images | Your bucket | At rest, by your provider |
| Login tokens | Your PostgreSQL | Hashed with AUTH_TOKEN_PEPPER |
Nothing is stored anywhere else. There is no vendor-side database, no analytics pipeline, and no model-improvement loop fed by your content.
Verifying rather than trusting
You can confirm the boundary empirically. Apply a default-deny egress policy allowing only DNS, PostgreSQL, and your storage endpoint, leave OPENAI_API_KEY unset, and run an analysis. It completes.
The policy is in Network.