Privacy & data handling

• Your ISMS records are stored in your browser's IndexedDB on this device only.
• Lovable Cloud manages accounts, memberships and billing metadata; Stripe manages payments. Your ISMS records are not uploaded or synced. No analytics, telemetry or external AI is used for those records.
• Documents, CSV files and backups are generated inside your browser.
• Organisation data is never placed in web addresses (URLs). Page addresses contain only generic identifiers such as clause numbers.
• The app loads only its own code and styles; it uses system fonts and no third-party scripts.

• No encryption at rest by this app. Data is protected only by your device and browser account security.
• No backup by us. If browser data is cleared, the workspace is gone unless you kept a JSON backup.
• Confirmed sign-in and active organisation subscription or authorised grant control entry to implementation tools. Local records are not a shared multi-user workspace or authenticated ISMS audit trail.
• Backup files are plain JSON; treat them as confidential.
• Checklist reviews and evidence-verification records are self-recorded local attestations. Reviewer identities are not authenticated and references are not independently verified.
• Organisational memory contains only explicitly approved, self-recorded decisions. Changed sources make decisions require review; retired or revoked decisions are not active memory. This is not machine learning.
• Local change reviews, record counters and recovery checkpoints are not a shared workspace, complete version history or immutable audit evidence. Recovery checkpoints are also unencrypted and disappear when browser storage is cleared.

Use fictional examples in a disposable browser profile for public demonstrations and participant practice. A public page does not create a shared classroom workspace: each participant keeps a separate local copy. Trainer View shows authored fictional lessons, but returning to participant pages can expose the open workspace on your screen.

Sign-in and subscription checks control normal access to the hosted tools, not encryption of stored records. Someone with control of this browser/device can inspect its downloaded code and local data. No app-managed encryption, independent backup or shared ISMS service is provided. Existing records remain downloadable through export-only local recovery even without an active subscription.

Data belongs to this browser profile and this exact site address. A published address, custom domain, different browser or device will not automatically receive your preview workspace. Download the full JSON backup at the old address first, keep that copy secure, then explicitly restore at the new address and check the records before discarding anything. Resetting or clearing the old profile is not a transfer.

Browser-local storage does not guarantee that the app will load without internet access. Offline startup is not supplied or verified. A host may record page requests and connection metadata; hosted TLS, access restrictions and log settings must be checked separately before release.

This tool supports ISMS implementation. It is not a certification guarantee, does not replace a licensed copy of ISO/IEC 27001:2022, and its templates and outputs alone do not establish conformity. Guidance is independently written and paraphrased; it is not the text of the standard.