Privacy & security
Confidentiality is a design constraint, not an afterthought.
This page states our privacy and security principles plainly. Where a specific operational detail — like a hosting region or a named certification — hasn't been finalized or independently verified, we say so rather than imply something we can't yet stand behind.
Our principles
What governs how your data is handled
Assessment confidentiality
Your responses are used to generate your own profile — never published, never sold, and never used to build a public profile about you.
Token security
Every assessment token is single-participant and single-attempt. It is validated on the server, never carries your scores or personal data in the URL itself, and is permanently locked the moment your attempt is finalized — whether by normal completion or automatic submission.
Personal-data handling
We collect the minimum needed to deliver your assessment and profile — principally your email address for token delivery. Your response-level data is not shared with a third party without your knowledge.
Profile access
Your profile is generated for you. In an organizational context, we distinguish participant-safe content from organization-only content — sensitive interpretive detail is never assumed shareable by default.
Organization permissions
Organizations access results only through the campaign and access permissions configured for their specific purpose in Phoenix Human Intelligence — never broad, unscoped access to every participant's full response data.
Assessment and scoring versioning
Every profile identifies the assessment version and scoring version it was generated from, so a result can always be traced back to the exact rules that produced it.
Retake and attempt history
A finalized attempt is never edited or deleted. A retake always creates a new, independent attempt — your prior attempts remain preserved, and every profile identifies which attempt it reflects.
AI boundaries
AI supports narrative interpretation only, strictly downstream of a deterministic scoring pass. It never changes a score, and it never gains access to build a profile beyond what your own profile document contains.
No question-bank exposure
Assessment questions, scoring formulas, forced-choice keys, cognitive answer keys, and validity thresholds are never published or exposed through the product — publicly or to participants — because doing so would undermine the instrument for everyone.
An honest note on scope
We do not publish security certifications, penetration-test results, specific encryption implementations, or hosting-region commitments on this page unless they have been genuinely established — doing otherwise would be a false technical claim, not a reassurance. As those specifics are finalized, this page will be updated to reflect them precisely.
Questions about privacy