Security · Privacy · Responsible AI

Built as if the queue were about you.

NuanceDesk exists to handle some of the most sensitive material on the internet. This page describes what is actually implemented — no certification badges, no aspirational claims.

Access & isolation

Workspace isolation: Every query, mutation, and action verifies workspace membership server-side before touching data. There is no cross-workspace read path.
Role-based permissions: Owner, admin, analyst, reviewer, and viewer roles gate every capability — creating cases, running analyses, finalising decisions, managing policy, exporting. Checks run in the backend; hiding a button is not our security model.
Authentication: Sign-in, sessions, and multi-factor options are handled by Clerk. NuanceDesk never sees or stores passwords.

Content handling

Redaction at intake: Links, contact handles, emails, and phone-like numbers are replaced with placeholders in the working copy. Viewers see redacted text only; higher roles can toggle the original when their work requires it.
Private file storage: Uploads are validated by type and size (10 MB default), hashed with SHA-256, stored privately in Convex storage, and deleted when their case is permanently deleted.
Safe URL ingestion: Only public http(s) URLs are fetched. Loopback, private ranges, link-local addresses, internal hostnames, embedded credentials, and non-standard ports are rejected; every redirect hop is re-validated; responses are time- and size-limited. Fetched content is treated as data, never as instructions.
No content in logs: Raw source material is never written to application logs. Audit events store safe metadata (event type, actor, timestamps) — not content.

Sharing & retention

Expiring share links: Share tokens are generated server-side, stored only as SHA-256 hashes, expire on a schedule (7 days by default, 30 max), and can be revoked at any time. Shared reports exclude source content unless the creator explicitly includes it — and then only the redacted version.
Configurable retention: Workspace owners set a retention period (7–3650 days). Case deletion removes the case, its analyses, evidence, comments, share links, and stored files.
Full deletion: Workspace deletion removes every associated record and stored file, including uploads in object storage.

AI safety constraints

No autonomous enforcement: The AI recommends; humans decide. There is no code path from an analysis to an enforcement action.
No identification of people: The system prompt forbids inferring identity, affiliation, or legal status, and forbids describing a person as a terrorist or member of an organisation beyond what a source explicitly states — attributed to that source.
Minimal excerpting: Analyses quote the minimum necessary, and are instructed to redact operational details, recruitment contact paths, personal data, and dangerous URLs from every excerpt.
Labelled provenance: Every analysis records its provider, model, prompt version, and schema version. If no provider is reachable the run fails explicitly — the system never fabricates an assessment.

Honest limits

NuanceDesk has not undergone SOC 2 or ISO 27001 certification and does not claim GDPR certification. Infrastructure-level encryption and availability are provided by our hosting and database providers (Vercel, Convex, Clerk) under their own published terms. If your deployment requires specific compliance guarantees, self-host the open configuration and validate it within your own programme. Questions are welcome — see the contact address in the footer, and the privacy policy and responsible AI statement.