Privacy Policy

Prova assesses model documentation against the SR 11-7 supervisory guidance. To do that, it has to read the documents you give it and store the results. This page describes exactly what is kept, who else sees it, and how to get rid of it. It describes the software as actually built — not a superset of what it might do someday.

1. What we collect

2. Uploaded files are never written to disk

When you upload a .pdf or .docx, it is held in memory only, for as long as it takes to extract the text. The buffer holding the original bytes is then explicitly zeroed. The file is never persisted to disk, never placed in object storage, and never retained after the request completes. The extracted text, however, is stored as described in section 1 — the file is discarded, its contents are not.

3. Who else processes your data

Prova is built on third-party infrastructure. Each provider below processes data on our behalf, under its own terms:

Two of these deserve emphasis. Anthropic receives your document text, because assessing it is the entire function of the product; that text is sent through Anthropic's commercial API, which does not use submitted content to train its models. Sentry records a sampled fraction of browsing sessions — roughly one in twenty ordinary sessions, and every session in which an error occurs — to help diagnose faults. These replays mask text content by default, but they capture your interactions with pages that display assessment results. Prova sells your data to no one, and shares it with no one beyond the providers listed above.

4. Aggregate benchmarks

Prova shows how a model's scores compare against others of the same type. These benchmarks are computed across all submissions in the system, including yours, so your assessments do contribute to figures other users see. What those figures expose is deliberately narrow: median scores per pillar, submission counts, and the five most frequent gap element codes with their frequencies. No document text, no gap descriptions, no model names, no submission identifiers, and no user identifiers ever enter a benchmark result. Nothing in a benchmark can be traced back to you or to a particular document.

5. Retention and deletion

We keep your data until you delete it. There is no automatic expiry, and deletion is permanent — Prova hard-deletes; it does not flag rows as hidden and keep them.

• A single assessment. Delete it from your submissions list. Its document text, gaps, and diagnostic record are removed with it.
• All assessments. Use the bulk delete in Settings to clear your entire history at once.
• Your whole account. Email us at the address below. Deleting the account cascades to every record associated with it — models, submissions, gaps, diagnostics, and preferences.

One caveat worth stating plainly: once your submissions are deleted they no longer count toward the aggregate benchmarks in section 4, but benchmark figures already displayed to other users are not retroactively recomputed in their browsers. Since those figures are medians and counts containing none of your content, this leaves nothing of yours behind.

6. How your data is protected

• Every database table enforces row-level security keyed to your user ID. A query made with your session simply cannot return another user's rows.
• Every API request is authenticated server-side before any processing begins, and state-changing requests are additionally checked against the application's own origin.
• All traffic runs over HTTPS. Credentials for third-party services are held in server-side environment variables, each confined to a single module, and are never exposed to the browser.
• Submitted text is stripped of HTML and script-like content before it is stored or sent to any model, and is passed to the agents inside explicit delimiters so that document contents cannot be interpreted as instructions.
• Assessments are rate-limited per account per hour, which bounds both cost and abuse.

No system is perfectly secure, and we make no claim of certification under any particular security framework.

7. Your choices

You can view everything held about you from your dashboard, export any assessment as a PDF report, correct a model's details by submitting a new version, and delete any or all of your data at any time. To request a copy of your data in another format, or to ask a question this page does not answer, write to us. Depending on where you live you may have additional statutory rights over your personal data — including access, correction, portability, and erasure — and we will honour any such request you make.

8. What Prova is not

Prova produces an automated, advisory assessment. It is not legal advice, not regulatory advice, and not a substitute for independent model validation or examination by your regulator. Scores are generated by language models and can be wrong. Nothing here creates any assurance that documentation Prova rates as compliant will satisfy a supervisory review.

9. Changes to this policy

If our data practices change, this page changes with them and the effective date at the top is updated. Material changes affecting data already collected will be communicated to the email address on your account before they take effect.

10. Contact

Questions about this policy, or requests concerning your data, go to atutejawork@gmail.com.