Every control, labeled with its real status.

Website inquiries. The clinic booking form collects name, work email, company, role, and an optional description of your workflow problem — only what is needed to respond, schedule, and assess pilot fit. Scheduling happens after the request is received. The form does not accept file uploads.

Evaluation data. Synthetic, redacted, or representative loss-run files shared under a pilot or clinic agreement, via a documented data-sharing procedure provided after booking — never through the general contact form or plain email attachments of production data.

Production claim data intake at scale. Not offered at this stage. Initial evaluations are designed to run on synthetic or redacted data.

Location. The processing and storage location is stated in writing in each pilot agreement before any file is exchanged, and will be published here once the standard hosting arrangement is finalized.

Encryption. Encryption practices are documented in each pilot agreement. Specific claims about encryption in transit and at rest will be published here only once independently confirmed, rather than asserted by default.

Access. Access to evaluation data is limited to the founder and any named personnel listed in the pilot agreement. Access-logging status is documented per pilot and is not claimed here until confirmed.

Independent security attestation. No SOC 2 or equivalent audit has been completed. One is planned only after pilot demand justifies it; until then, this page and the pilot agreement are the controls documentation.

Retention. Evaluation data is retained for the pilot term plus a retention window stated in the pilot agreement, then deleted. Website inquiry information is kept only as long as needed to respond and assess pilot fit.

Deletion. On pilot exit or on request, uploaded data and derived working data are deleted, with written confirmation. Backup copies age out on the backup cycle, which may extend final removal by the backup cycle stated in the pilot agreement.

Ownership. Uploaded data remains the customer's property. Work products generated from a customer's data are the customer's to use. The pilot agreement states both explicitly.

A current subprocessor list (hosting, email, scheduling) is provided with each pilot agreement and will be published here once the launch service providers are finalized.

Standard (shared multi-tenant service). The intended standard offering, used for pilots.

Dedicated. A separate instance or dedicated infrastructure in Prior Experience's cloud environment. Under evaluation; not currently offered.

Customer cloud. Deployment into the customer's AWS account or VPC. Under evaluation; raise it during the clinic if it is a requirement.

Customer hosted (on-premises). A concept under consideration only. It will not be represented as available until it is.

Incident handling. Suspected incidents affecting pilot data are investigated and affected participants are notified without undue delay, as set out in the pilot agreement.

Reporting a concern. Email hello@priorexperience.io. Security and data concerns go directly to the founder.