Trust and data
Written for a security review. Last updated October 29, 2026. Each statement here was checked against the code that makes it true.
Who runs this
All the Possibles is one person, John Howrey, working from Texas. The tools are checks that people and their agents run on work before it ships: an MCP server scanner, a design critique, a Core Web Vitals monitor, design review tools, small developer utilities, accessibility checks and a Search Console dashboard. Everything runs on Cloudflare Workers, and Cloudflare D1 is the only database. There are no outside investors, no advertising, no ad network and no analytics vendor. This page exists so the person asked "can our designers use this?" can answer from what the code does.
What you send, where it goes, how long we keep it
One row per product. Every product also writes the content-free usage events described in the next section.
| Product | What you send | Where it goes | What we keep, and for how long | Keeping it off our servers |
|---|---|---|---|---|
| Preflight | An MCP server URL, with an optional authorization header for that server; a VS Code extension id; a Claude Skill file; a document URL or the document text. | Our Worker calls the server's tools/list, looks the extension up on the Visual Studio Marketplace, or fetches the document. On a Pro key the semantic pass sends the tool descriptions or the document text to Anthropic on our account. | A scan record for 30 days: target URL or extension id, server name, tool names and their hashes, findings and risk score. A content scan keeps the source URL (or the words "inline content"), the length and the findings, never the text. The authorization header is forwarded to the target and not written anywhere. | There is no local mode. A free scan sends nothing to a model; the semantic pass runs only on a Pro key. |
| Design Check | A page URL. | Our Worker fetches the page. The vision pass screenshots it through Cloudflare Browser Rendering and sends the screenshot to Anthropic, on your account if you send x-anthropic-key, otherwise on ours. | A check record with the URL, score, verdict and findings. These are not deleted automatically yet; we delete them when you ask. | Send x-anthropic-key and no screenshot reaches a model under our account. |
| Pulse | URLs to monitor. | Google's Chrome UX Report API and PageSpeed Insights API receive each URL. | The monitored URLs against your key's hash, and each check's report, for as long as the subscription runs. Deleted on request. | A public URL is the only input; nothing else leaves your machine. |
| Verdict | The design, copy or screen description you want reviewed. | Anthropic, on your account if you send x-anthropic-key, otherwise on ours. | Nothing from the content. One usage row per caller per UTC day (call count and cost, keyed by key hash or IP address), deleted after 7 days. | Send x-anthropic-key; the text passes through our Worker to Anthropic under your account and we hold no copy. |
| Toolbox | Text, a manifest, JSON, a JWT, an .env file, or a URL. | Nowhere. The tools that take a URL fetch it from our Worker with no credentials. No model is called. | Nothing from the input. | Nothing to do: inputs live in memory for the request and are gone when the response is sent. |
| Designers | Colors, HTML, page URLs, copy, research plans. | Nowhere, except that the tools which take a page URL fetch it from our Worker. No model is called. | Nothing from the input. Project context a Pro key saves on purpose (a DESIGN.md, brand notes), up to 20 items, is deleted 30 days after you cancel or when you ask. | Do not save project context; every other tool leaves nothing behind. |
| Vantage | A Google sign-in and the Search Console properties you add. | Google's Search Console API, read-only. | The OAuth token and the chosen properties for the life of the account; removed when you disconnect the Google account. | Not applicable; it is a hosted dashboard. |
| Accessibility report and free check | A site address and an email address. | Our Worker fetches up to ten public pages of the site. No model is called. Resend sends the report link. | Email, site address and the finished report for 30 days at an unguessable link. The paid order record (email, site, Stripe session id, status) stays until you ask. | Not applicable. |
| allthepossibles.com | An email address if you sign up for the monthly note; a purchase in the shop. | Resend sends the confirmation. Stripe takes payment on its own page. | The subscriber address until you unsubscribe; the order record for bookkeeping. | Not applicable. |
Usage events, the one thing every product logs
Each page view and each tool call writes one row: a timestamp, the event type, the path, the referrer, the country Cloudflare reports, and small metadata such as the tool name, the plan and the verdict. The visitor id is a SHA-256 hash of IP address, user agent and the UTC day, cut to 32 characters; a second id uses the ISO week instead of the day. Neither is a cookie, and neither survives its period. Calls made with a Pro key carry the key's hash. No submitted content, no scanned URL and no key goes into an event. Rows older than 90 days are deleted by a job that runs every hour in each Worker; the studio Worker repeats the delete on every product database it can see, so a missed tick in one product changes nothing.
Retention, in days
| Table | What is in it | Kept for | Deleted by |
|---|---|---|---|
| events (every product) | Page views and tool calls: timestamp, type, path, referrer, country, hashed visitor id, small metadata | 90 days | Hourly, in each Worker, plus the studio Worker as a backstop |
| rate_limits (every product) | Key hash or IP address, window start, request count | 7 days | Hourly, same job |
| Preflight scans, extension_scans, content_scans | Target and findings as described above | 30 days | Hourly, in the Preflight Worker |
| Verdict free_usage | Key hash or IP address, day, calls, cost | 7 days | Hourly, in the Verdict Worker |
| Designers project_context | Named notes a Pro key saved | 30 days after cancel, or on request | Daily |
| Free check results and reports | Email, site, result | 30 days | Every minute with the report queue |
| Design Check checks, Pulse checks, Vantage connections, Stripe customer ids, shop orders | See the product table | No automatic deletion | On request, within a week |
Rate-limit rows in Preflight, Verdict, Design Check and Pulse were keyed by the API key itself until October 29, 2026; since then they carry the key's SHA-256 hash, as Toolbox and Designers always did, and the old rows age out within 7 days.
Subprocessors
Five companies touch customer data on our behalf. Adding a sixth changes this list and the date at the top of the page, and customers on a paid plan hear about it by email first.
| Company | What it does for us | What it sees |
|---|---|---|
| Cloudflare | Hosting (Workers), the databases (D1), screenshots for Design Check (Browser Rendering), inbound email routing | Everything |
| Stripe | Payment and subscription records | Card details (we never see them), email, customer and subscription ids |
| Resend | Transactional email: API keys on subscribe, report links, Pulse alerts, the monthly note | Email address and the message |
| Anthropic | Model calls for Verdict, Design Check's vision pass and Preflight's Pro semantic pass, when you do not send your own key | The content being reviewed |
| Chrome UX Report and PageSpeed Insights for Pulse; Search Console for Vantage; one font file on every page | URLs (Pulse), a read-only OAuth grant (Vantage), the font request |
Your browser also loads two stylesheets on every page, from Adobe Fonts (use.typekit.net) and Google Fonts, so those two services see the request the way any content network does. No script from either runs; no page carries third-party JavaScript at all.
Where data lives, and how it is protected
Workers run on whichever Cloudflare location handles the request. No D1 database has a location hint set, so Cloudflare chooses the primary region; a region can be pinned per customer on request. Every endpoint is served over TLS only, and D1 encrypts data at rest (Cloudflare's statement). The Stripe, Resend and Anthropic keys are Cloudflare encrypted variables set outside the repository; each wrangler.toml holds price ids, a public base URL and database ids, nothing secret.
Access
One person holds production access to Cloudflare, GitHub and Stripe. Deploys run through GitHub Actions from the repository's default branch, with the shared kit pinned to a commit hash; nothing deploys from a laptop. The owner states that two-factor authentication is on for all three accounts; the factor type is available on request for your questionnaire.
Practices
- No tracking cookies. The only cookie anywhere is the Vantage session.
- Rate limits per key and per IP address on every API, with the key stored as its hash.
- Each product's only runtime dependency is the shared kit, pinned by commit hash. The kit's one runtime dependency is Stripe's SDK.
- A bring-your-own-key header on Verdict and Design Check is used for that one request and never written to a log, a database or an event.
- Security contact: security@allthepossibles.com, routed to the owner. You get an acknowledgment within two business days and a fix or a dated plan within ten for anything that exposes data. Report in private, stay inside your own data and the published rate limits, and we will credit you if you want and never pursue good-faith research.
What we do not have
| Missing | What you get instead |
|---|---|
| SOC 2 report | This page, and a security questionnaire answered within five business days. |
| ISO 27001 certificate | Same as above. The scope of a one-person studio fits on one page; this is it. |
| Penetration test report | A test window against the live endpoints on request, inside the published rate limits, with findings fixed and credited. |
| Signed DPA template | We sign yours. Send it to the address below. |
| Single sign-on | None. Access is by API key; ask for one key per seat and we will issue them. |
| Per-customer audit logs | The /api/usage endpoint on each product returns your key's call counts, and we export your key's events rows on request. |
| On-premises or private-cloud install | None. The nearest option is a D1 region pinned for your data, and bring-your-own-key so no content reaches a model under our account. |
Bring your own key, and running with nothing stored
Verdict and Design Check accept an x-anthropic-key header. With it, the model call runs on your Anthropic account and we hold no copy of the key or the content. Preflight's semantic pass runs on our key only today; a header for it is on the list, and a free scan never calls a model. Toolbox and Designers call no model in any mode. For a no-storage review: Toolbox, Verdict and Designers write nothing from the input in any mode; Preflight writes a scan record, so ask us to delete it by target URL if a record cannot be kept.
For procurement
On any paid plan, at no charge: a security questionnaire answered within five business days, a DPA signed on your paper, a subprocessor change notice by email, a D1 region pinned for your data, and deletion of everything tied to your key within a week of asking. Write to security@allthepossibles.com.
Changes to this page
- October 29, 2026. First version. The same day: hourly retention jobs for events (90 days) and rate limits (7 days) in every product, Preflight scan records cut to 30 days, rate-limit rows re-keyed from the API key to its hash in Preflight, Verdict, Design Check and Pulse, and the security@ address added.