This version is for public-source research. It is not approved or independently tested for confidential operational information.
Private site access
Configured for the owner’s account at publication. Account access and device security still matter. A private link does not encrypt records already stored in a browser.
Local records and backups are unencrypted
Reports remain on this browser between visits. Signing out does not erase them. JSON backups and text briefings are also unencrypted. Verification labels are a review workflow, not information-security classifications. Do not store principal identities, live movements, passwords or confidential client reporting here.
Browser protections added
The app’s content policy restricts scripts and styles to this site and blocks app-initiated network connections and embedded pages. Imported records are validated and report text is escaped. These controls do not protect a compromised device or replace a security audit.
Before operational deployment
Add managed authentication and access roles, protected server-side storage, encryption and key management, audit logs, tested backups and recovery, data retention rules, and independent penetration testing. Agree the hosting and data-handling requirements with the organisation before uploading operational information.