SECURITY & TRUST
Your reflection.
A private space.
Public knowledge and personal information deserve different treatment. Our science library is open. Assessment responses and individual reports require authorized access.
Account separation
Purchasing accounts can access their own orders, invitations, progress, and completed reports. Access is checked on the server. Database policies provide an additional boundary between accounts. A purchaser does not receive a participant’s raw questionnaire answers through the account export.
Invitation protection
Invitations expire after 30 days and can be revoked. The participant who begins an assessment receives a protected browser session. After the invitation is claimed, possession of the link alone does not reveal that person’s answers or report. Keep the invitation private and use the same browser to resume. Losing that browser session may require a replacement assessment.
Administrator access
Platform administration requires the dedicated business account and a verified authenticator code. The administration dashboard provides order and usage information. It is not a public directory of participants or reports.
Reports and retention
Personal PDF reports are generated on the server for an authorized request. They are not stored in a public file bucket or added to search indexes. Participants can export or delete their responses from their active session, and purchasers can delete assessment data from their dashboard. Completed report data, responses, and the chosen name are retained for one year (365 days) after completion unless deleted earlier. Incomplete assessment data follows the same period from the start of participation. Invitation and browser-session access still expire after 30 days. See the privacy notice for scheduled deletion and its limits.
Hosting and availability
Netlify hosts the application, and Supabase provides authentication and private data storage. Availability depends on those services and their operating limits. We do not offer a contractual uptime guarantee. The retention schedule runs within the database so that routine removal of older assessment content does not depend on the website host being available.
What we do not claim
No service can promise perfect security or uninterrupted operation. We do not claim a completed independent penetration test, security certification, or contractual uptime guarantee. New releases are checked for dependency advisories, authorization boundaries, scoring behavior, and report generation. Operational monitoring, restore testing, and independent review remain part of ongoing engineering work.
Report a concern
Contact Admin@machiavelliassessments.com. Describe the issue without sending passwords, access tokens, raw participant answers, or reports. We can arrange an appropriate way to investigate sensitive details.