Trust

Who runs Path

I'm Michael Rowe, and I build and run Path on my own, as a sole trader registered with the Information Commission (the ICO). Path runs on established managed services and has no servers of its own.

Path is in alpha. Accounts are by invitation only, and I'm testing it in small pilots. It holds no security certifications, and I don't yet hold professional indemnity or cyber insurance. Both kinds of insurance will be in place before Path takes on paying users or organisations.

Where your data lives

Portfolio content, uploaded files and accounts are stored by Supabase in the European Union (Ireland). Data is encrypted at rest and in transit.

There are currently no backups of the database or of uploaded files, so data lost through a fault can't be recovered. Backups will come before Path is used for organisational deployments.

A small number of named sub-processors help run the service. The privacy policy lists each one, what it does and where it processes data. Path doesn't sell data and runs no analytics or advertising tracking.

Who can get in, and what they can see

• Row-level security in the database decides what each account can read, so one person's portfolio can't be read by another, whatever the app does.
• Two-factor authentication with an authenticator app is available on every account. An organisation can require it for its members.
• Organisations see anonymous totals. A member's own work becomes visible to their organisation only when they share a specific path with it or submit one for review. The reviewers allocated to a submission read all of it, including any reflections attached to the path.
• Any figure in an organisation's reports that comes from fewer than five people is hidden, so a small total can't identify anyone.
• If someone joins an organisation's mentoring programme, the programme's lead can see who they're paired with.
• Administrator permissions are checked on the server as well as in the interface.

AI in Path

Path's one AI feature is Ask, the help chat. It answers questions about how Path works from Path's own help content, and it can't read anyone's portfolio.

Whatever you type into Ask is sent, with the help content, to Anthropic, whose Claude model writes the answer. So if you type something from your portfolio into the question, that goes too. Questions and answers are logged against your account, which is how I find out what the help doesn't yet cover. The privacy policy has the details.

How the app is protected

• Every connection uses HTTPS, with HSTS and standard security headers that stop other sites framing the app or browsers misreading its content types.
• Security updates to dependencies are proposed automatically. I review and test major upgrades before adopting them.
• Every change is type-checked, linted, built and run through automated accessibility tests before release.

If something goes wrong

Path has a written incident response plan. If a personal data breach is likely to put people's rights and freedoms at risk, I report it to the Information Commission (the ICO) within 72 hours, and where the risk to the people affected is high, I tell them without undue delay.

Current availability and any incidents are shown on the status page, which is hosted separately so it stays up when Path doesn't.

If you think you've found a security vulnerability, please tell me through the contact page rather than disclosing it publicly.

What's in progress

• Daily database backups, and a tested restore.
• Signed data processing agreements with each sub-processor.
• Meeting the Cyber Essentials requirements.
• External uptime monitoring with alerting.

Asking for more

If you're assessing Path for your organisation and need more detail, or have a security questionnaire to complete, get in touch through the contact page.