Security & data handling
There is no server in the path of your course files, because there is no server StoryAudit sends them to.
Client-side, by architecture, not by policy
When you open a .story file in StoryAudit, the file is read and parsed entirely inside your browser tab, using the browser's own File API. There is no upload step, because there is nothing to send it to: StoryAudit doesn't have a backend that accepts course files. The parsing, the health checks, the quiz answer extraction, the version comparison, all of it runs as JavaScript executing locally on your machine, the same way a spreadsheet app parses a file you open from disk.
It's the only way the tool works. There's no server-side code path for course content to travel through, so there's nothing to misconfigure, no upload log to secure, and no third party in the chain who could see the file even if they wanted to.
What never happens
- Your .story file is never uploaded. It's read from disk into browser memory and never transmitted anywhere.
- Nothing is stored on a server. There's no database of course content, because there's no server-side storage layer handling course content at all.
- Nothing leaves your machine, ever. To make repeat audits faster, the app does keep a cache of recently generated reports and a local run history in your browser's own on-device storage (IndexedDB), never transmitted anywhere, and separate from the "no upload" guarantee above. See the privacy policy for exactly what's stored and how to clear it.
- No course content is used for analytics, training, or any other purpose. There's no pipeline for that, because the content never reaches infrastructure that could do it.
DPA and security overview
For procurement or legal review, both documents below describe this architecture formally and can be shared with your security or privacy team as-is.
See also the privacy policy for the full plain-language explanation of what data StoryAudit does and doesn't handle, including account and billing information (which is separate from course content and is handled by our payment processor).
Common procurement questions
- Does StoryAudit need network access to work? No. Once the page has loaded, opening and analyzing a .story file works with no network requests for the file itself. (Loading the page, checking for app updates, and license validation do use the network.)
- Can StoryAudit see the contents of our courses? No. There's no path for course content to reach us; it's processed entirely in the browser session that opened it.
- Where does the .story file go after I close the tab? Nowhere. It was never sent anywhere to begin with. The in-memory working copy used during analysis is discarded when the tab closes; a report cache and run history persist on-device in your browser's own storage (never transmitted) so repeat audits are faster, and both can be cleared at any time; see the privacy policy.
- Is this covered by a signed agreement, not just a webpage? Yes, see the DPA above.