Security
AxiomFlow compares insurance documents without ever receiving them. This page explains how, and how you can check it yourself.
Where your documents go
Nowhere. Files you add are read, OCR'd, and compared by code running in your own browser. There is no upload step, no AxiomFlow server that processes documents, and no AI service involved. We could not see your documents, client names, or results even if we wanted to.
What we can and cannot see
| Information | Can AxiomFlow see it? |
|---|---|
| Your documents, their text, and page images | No. They never leave your browser. |
| Comparison results, notes, review decisions, sign-offs | No. Stored only in your browser. |
| Client names, agency name, logo, license code you enter | No. Stored only in your browser. |
| That someone loaded the website (IP address, browser type, time) | Our host, Cloudflare, processes standard request details to deliver the page, as every website host does. We add no analytics or tracking. |
| Your name, email, and subscription status, if you subscribe or email us | Yes, through Stripe and email. Never your full card number. |
How the website is built
- One static page. Our server (a Cloudflare Worker) only hands your browser the page and these policy pages. It accepts only page requests (GET and HEAD) and has no endpoint that can receive files or data.
- Strict Content Security Policy. The page may only run its own code (pinned by cryptographic hash) and version-pinned open-source libraries: PDF.js 4.10.38 (Mozilla) and Tesseract.js 5.1.1 with its English language data, plus the IBM Plex fonts. The same policy restricts which addresses the page may contact, so it cannot send data anywhere else, including to us. Injected or modified scripts are refused by the browser.
- No accounts, cookies, analytics, ads, or tracking. Nothing to breach, phish, or leak.
- Locked-down headers. HTTPS only (HSTS), no framing by other sites, no referrer leakage, and no access to the camera, microphone, location, or payment features. (Phone photos are chosen through your phone's normal file picker.)
What is stored, and where
| Data | Where | How long |
|---|---|---|
| Saved comparisons: text, page images, review decisions, notes, sign-off | This browser's private storage (IndexedDB) on your device | Deleted automatically after 7 days, or anytime with Delete or Delete all (under Recent) |
| Report details: agency name, preparer, logo, license code | This browser (localStorage) | Until you remove them or clear site data |
| Offline copy of the AxiomFlow page and the public reader libraries (PDF.js, text recognition, fonts) | This browser's cache, kept by AxiomFlow's offline helper (a service worker) | Replaced when AxiomFlow updates; contains no documents or results |
| Downloaded reports (PDF, CSV, JSON) | Wherever you save them | Under your control |
| Anything on AxiomFlow servers | None | Not applicable |
Because results live in your browser, use a device and Windows or macOS account that only your staff can access, and keep it locked when unattended, as you would for your agency management system.
Check it yourself in two minutes
- Open AxiomFlow in Chrome or Edge, press F12, and choose the Network tab.
- Run a comparison with any PDF.
- Every request you see is the page itself or a download from
cdn.jsdelivr.net(the PDF reader, the text-recognition engine, or the fonts). All are downloads to your browser. None of them carry your document; there is no upload request. - Optional: after one comparison of a PDF and one of a scan, turn off Wi-Fi, close and reopen AxiomFlow, and compare again. It still works, because nothing needs the internet. (The offline helper only keeps a copy of the page and the public reader libraries; it never sees your files, which are opened directly from your computer.)
Third parties
| Provider | Role | Sees your documents? |
|---|---|---|
| Cloudflare | Hosts and delivers the website | No |
| jsDelivr | Delivers the open-source PDF and OCR libraries and the fonts | No |
| Stripe / Link | Processes paid subscriptions | No; billing details only |
Answers to common vendor questions
Agencies often review software vendors against a checklist such as the Big “I” AI Vendor Evaluation Checklist. Short answers:
| Question | Answer |
|---|---|
| Who owns the data? | You. We never receive it. |
| Where is data processed and stored? | Only in your browser, on your device. No AxiomFlow server, database, or cloud storage holds documents or results. |
| Is data used to train AI models? | No. No AI service is involved, and no data reaches us. |
| How is data encrypted? | The site is served only over HTTPS. Documents are not transmitted, so there is nothing to encrypt in transit; saved results stay in the browser's storage on your device, protected by your device and account security. |
| Retention and deletion | Saved results are deleted automatically after 7 days. Delete or Delete all removes them immediately. |
| Audit trail | Each review records who reviewed each change, when, notes, the sign-off, and SHA-256 fingerprints of the exact files reviewed (in reports on the paid plan or trial). |
| Human review | Required. AxiomFlow lists changes and shows their source; a licensed professional decides what they mean. |
| Sub-processors | Cloudflare (hosting), jsDelivr (library and font delivery), Stripe/Link (billing). None receive documents. |
| Certifications | No SOC 2 report yet. The design avoids holding customer data, which removes most of what SOC 2 audits. |
| Exit and portability | Download any comparison as PDF, CSV, or JSON at any time. There is nothing to export from us. |
Reporting a vulnerability
Please report security issues to jordanpetan05@gmail.com. We follow the security.txt standard. We will acknowledge reports within 3 business days and will not take legal action against good-faith research that avoids harming users.
Accuracy and responsibility
AxiomFlow is a factual text comparison tool that finds what changed and shows where. It does not interpret coverage or give advice. Results from scans and photos depend on image quality, so findings marked as read from a scan should be checked against the source. A licensed professional should review every finding before relying on it.
Questionnaires and contact
We are an early-stage company and do not yet hold a SOC 2 report; our design avoids handling customer data at all. For a full vendor security questionnaire, email jordanpetan05@gmail.com (send a message).