Probative LabsSecurity and privacy
Built to need as little of your data as possible.
The default way to start needs none of it: you run the check on your own machine and share only the summary. When data does move, it is only what the analysis needs, and never used to judge individuals.
Where it runs
| Option | Status | Where the data lives |
|---|---|---|
| The free check, in your browser | Available now | Your browser: the page cannot send data anywhere |
| The open-source engine, on your computer | Available now | Your computer |
| Probative Labs Cloud, in your own cloud | Available as a Docker package; not yet run by a customer | Your AWS, Azure or Google Cloud account |
| Probative Labs Cloud, hosted for you | Planned | A US or EU region you choose |
Data minimization
- Only the fields the analysis needs; the field list is public. Connectors are read-only and never write back.
- Timestamps, categories, teams and outcomes. Free text is read to type work, then dropped.
- Names and user IDs are replaced with keyed hashes before anything is stored; raw uploads are not kept.
- Team-level results only, with a minimum group size.
People and regulation
- Evaluates AI programs, not people: no scoring, ranking or monitoring of individual workers.
- In the default pilot I never receive personal data. If you choose to send exports, a data processing agreement comes first.
- No language model sees your data: the analysis is statistics.
- Retention in Cloud is configurable.
Security program
- Secrets encrypted in the database; TLS wherever Cloud is hosted.
- Single sign-on (OpenID Connect), five roles and an append-only audit log.
- Strict browser security headers; no third-party scripts or trackers.
- A penetration test before general availability; SOC 2 Type II, ISO 27001 and ISO 42001 planned, in that order.
On request: a mutual NDA, a one-page security note and the exact field list. To report a vulnerability, use the private reporting channel on the GitHub repository or email vivek@probativelabs.com.