Data & Security
Where Cause Map data goes
The Cause Map is local-first: investigation data is processed in your browser, not stored in a process_safety.ai account or cloud workspace. This page describes the current controls, data flows, and user responsibilities.
Local-first does not mean risk-free. Browser storage and exported JSON files are not encrypted by the application. Treat the device and each export according to the sensitivity of the investigation and your organization’s records and cybersecurity requirements.
1. Data-flow summary
| Data | Where it goes | User control |
|---|---|---|
| Cause Map, outline, timeline, process map, and solutions | Browser memory; IndexedDB only if autosave is enabled | Use without saving, enable or disable autosave, clear local data, export JSON |
| Evidence documents and media | Browser memory; local autosave when enabled; embedded in JSON export | Add, preview, remove, clear, or export |
| Autosave preference | Browser local storage | Change from the Cause Map toolbar or clear browser site data |
| Imported and exported JSON | Read from or written to the device by the browser | You choose the file and where it is stored or shared |
| Beta and feedback forms | Validated by our server, then forwarded to Winterlude | Choose whether and what to submit; do not include investigation content |
| Product analytics | Pageviews and allowlisted, content-free events sent to Umami through a same-origin proxy | Enabled automatically when configured; browser Do Not Track is honored |
2. Local Cause Map storage
Without autosave, working data exists in browser memory for the current session. With autosave enabled, the browser stores the full working state—including attachments—in IndexedDB. The tool treats a draft as expired 30 days after its most recent save and removes it when the Cause Map next opens.
Clearing site data, using private browsing, browser storage eviction, device-management policies, or changing browsers or devices may remove the draft. We cannot recover locally stored data because we do not receive it.
3. Attachments and JSON files
The current Cause Map and timeline accept images, video, PDF, Word, Excel, TXT, and CSV evidence files. A Cause Map can contain up to 20 attachments, with an 8 MiB limit per attachment and a 40 MiB combined limit. These limits are checked when files are attached, exported, and imported. Import files are limited to 64 MiB.
Export converts attachments into base64 data embedded in the .causemap.json file. This preserves evidence during an export/import round trip, but it also means anyone who can read the export may be able to recover the attachments. The export is not password-protected or encrypted by this application.
Store exports only in approved locations, apply access controls or encryption where required, and verify recipients before sharing. Imported files should come from a trusted source. File validation reduces risk but does not make an untrusted file safe.
4. Privacy-first analytics controls
- Analytics loads automatically when the Umami service is configured.
- Umami is loaded through the site’s origin.
- Automatic page tracking is enabled across the site; URL query and fragment collection remain disabled.
- A client-side allowlist permits only named workflow events and a small set of fixed category values.
- Cause Map text, timeline details, names, filenames, attachment metadata and content, and form text are excluded.
- Do Not Track is honored.
- Client IP forwarding to Umami is disabled in the default server configuration.
The hosting and network layers still receive information needed to deliver requests, including an IP address. See the Privacy Notice for collection, disclosure, retention, and rights information.
5. Application security controls
The current implementation includes:
- restrictive Content Security Policy, framing protection, MIME-sniffing protection, referrer controls, and limited browser permissions;
- same-origin analytics proxying so the browser does not directly contact an analytics host;
- form validation, request-size limits, a honeypot, timeouts, and per-IP rate limiting;
- JSON structure, nesting, text-length, node, edge, collection, attachment-type, and attachment-size validation;
- safe DOM rendering patterns and no execution of imported JSON as code; and
- no current account password, payment-card, or cloud investigation repository to protect.
Production hosting is expected to provide HTTPS. The application sends an HSTS header and other security headers, but transport security and availability also depend on the selected hosting and network providers.
6. Your security responsibilities
- Use a trusted, supported, patched browser and device.
- Do not enable autosave on a public or shared device.
- Lock the device and restrict access to its browser profile.
- Export backups to an approved records system when retention is required.
- Encrypt sensitive exports using an organization-approved method.
- Do not use public forms or ordinary email for confidential investigation evidence.
- Apply your organization’s incident, legal-hold, privacy, records, and export-control procedures.
- Have qualified personnel validate the completed analysis before acting on it.
7. Current limitations
The current Service does not provide server-side encryption for Cause Map content, enterprise key management, centralized access control, audit history, version history, legal hold, administrator controls, single sign-on, formal records retention, backups, disaster recovery for local data, e-signature, regulatory validation, or security certification. Some of these capabilities may appear on the product roadmap, but they should not be treated as available until released and documented.
Appropriate-use decision: organizations should perform their own risk assessment before using the current browser-only tool for confidential, privileged, regulated, or safety-critical records.
8. Report a security or privacy concern
Email hello@process_safety.ai with the subject “Security report.” Include enough detail to reproduce or assess the issue, but do not send live credentials, personal data, proprietary Cause Maps, or harmful exploit code in the first message. We will reply with a safer way to exchange sensitive details if needed.
9. Changes to this document
We will update this page when architecture or security-relevant capabilities materially change, including the introduction of accounts, cloud storage, collaboration, audit history, or paid features.