The design assumption behind XIRIQ is that assessment content is sensitive. The architecture, not just policy, keeps it private.
What we store
Your account details, your assessments (setup, statuses, notes, overrides), your evidence records as citations, and attachments only if you enabled them. Hosting is UK/EU, and pages load nothing from third-party origins: fonts and assets are self-hosted, so reading the app does not leak requests elsewhere. Documents you cite by reference are never fetched or stored.
Who can see what
- You see your own assessments. There is no sharing model; other users cannot see your content.
- XIRIQ staff do not see assessment content. Plainly: your titles, answers, notes, evidence records and attachments are not visible in any staff-facing view.
- The AI provider receives assessment data only when you choose to generate an executive summary. That is the single deliberate exception, and it never happens in the background.
The admin boundary
The administrative area is metadata-only by design: counts, scores and timestamps for operating the service. It never renders assessment titles, site names, answers or evidence, and this boundary is enforced by tests, not convention. Evidence type and status label lists are admin-configurable, but they are configuration; the records using them stay invisible. When you delete your account, the data goes with it.