Security
How we protect your information
A plain summary of how we protect what you give us.
Draft for review. This page is not final until Steve Tunstall has approved the exact wording.
Your answers
- Your answers stay in your browser tab while you answer. They are sent to us only if you ask for the PDF or buy.
- When you ask for the PDF, we keep only your score, label and date. We do not keep your answers.
Signing in
- Email one-time codes expire after 10 minutes and allow a limited number of attempts.
- Our own admins sign in with a password and an authenticator code. Admin access is limited to named people.
- Releases, refunds, deletions and previews of a pack are logged.
Payments
- Card details go directly to Stripe and never touch our servers.
- Orders are fulfilled only from payments confirmed by Stripe's signed messages.
The platform
- Hosted on Google Cloud in Singapore, with abuse protection, rate limits and strict browser security headers.
- Secrets are kept in a managed secret store, never in code.
- Backups are kept and tested.
- The site was security tested by an independent reviewer before launch, and the findings were fixed and re-tested.
Found a problem?
Please tell us at gretchel@tunstallasc.com. We will look at it promptly.
Last updated: 30 October 2026. Questions: gretchel@tunstallasc.com