Privacy and security

Your report stays yours.

This page is the same one page note we give IT security teams, data protection officers and works councils.

Download the note to forward it

For IT security, data protection officers and works councils. One page. Plain language. Community tool by Incubane, a Workday partner.

In one sentence

The kit runs in your browser and saves your work there. You sign in with a free Incubane account first. The kit asks once per device whether to sync between your devices. With a yes, your plan, notes, people, photos and reports are encrypted on the device, with a key only your devices hold, before a copy goes to Incubane's EU storage. You can turn sync off ("Keep everything on this device") at any time. With Incubane AI (the default), your photos and notes pass through incubane.com to Claude by Anthropic to be read, and Incubane stores none of that content. With your own AI tool and sync off, no content reaches Incubane: it goes only to the AI tool you paste it into, the one your company already approved. With your own AI tool and sync on, Incubane stores only the encrypted copy.

Two modes

If your company only allows its own AI tool, pick that tool in the Studio and turn sync off on the home page ("Keep everything on this device"). Everything below marked "own AI" then applies. To block the service at the network level, block /api/rising/ai, /api/rising/sync*, /api/rising/team and /api/rising/handoff; the kit keeps working on the device.

GDPR at a glance

Please do not upload

Screenshots of a Workday tenant, employee data or anything confidential from your employer. The kit is for conference slides and your own notes.

What the kit is

A web app at incubane.com/rising. The core runs in the browser. Hosting: Vercel. Incubane AI adds one server route (/api/rising/ai) that checks the sign-in and the limits, calls the Anthropic API and streams the answer back. Team spaces use Supabase in the EU (Frankfurt) and store encrypted data only.

Data flow

What Incubane receives

With your own AI tool, your account and the anonymous event counts below, through Plausible (EU hosted, no cookies). With Incubane AI, also the usage line described above. Each event has at most one property, and its value is a fixed word or a range, never your input.

The list is enforced in code (packages/core/src/analytics/events.ts); an event or value that is not on it is dropped. Page views send the route only, with report and team ids replaced by :id.

Browser security

• Content Security Policy: scripts only from the kit itself, the analytics script and Cloudflare Turnstile. The policy is one header for every kit path, so it allows Turnstile everywhere; the code loads it on the sign-in step only. No other third-party scripts, fonts or CDNs. frame-ancestors 'none', object-src 'none'.
• Referrer-Policy: no-referrer, so a team link never leaks in a referrer header.
• Permissions-Policy: camera, microphone, location and payment are off.
• HSTS, X-Content-Type-Options: nosniff.
• The prompts and data schemas are published under the MIT license, so anyone can check what the AI is asked to do.

Sync details

• Stored in Incubane's Supabase project in the EU (eu-west-1, Ireland): one row per item and one file per photo, all ciphertext. Only the site's sync routes can reach it; they check your sign-in and never see the key.
• What syncs: your plan and Studio work, quick capture notes, voice notes and their audio, people you met and daily recaps, photos and thumbnails, reports and team links. The names in "Who covers what" on the plan stay on the device.
• If two devices changed the same thing, lists are joined (notes, people, photos) and the device that syncs last keeps its own value for single fields.
• The QR code on the home page is a one-time pass, made only when you tap "Show the QR code". It works once, for 2 minutes, and signs the phone in as you and links it, so only show it on your own screen. Your sync key travels sealed with a secret that is only in the QR code (after the #, which browsers never send to a server); incubane.com stores the sealed key and a hash of the pass, hands the sealed key to the phone once, then deletes it. Used or expired passes get nothing. At most 10 passes an hour; all are deleted after a day.
• Lost every linked device: no device holds the key any more, so the synced copy is useless. Start over from a new device; the old copy is deleted.
• Sync off ("Keep everything on this device", on the home page): this device sends nothing and keeps its data; what is already synced stays until you delete it.
• "Delete your synced data" on this page deletes every synced item and photo (in rounds for a large library; the nightly cleanup finishes anything left) and leaves a marker. Every device that sees the marker forgets its key and stops; sync only starts again when the person turns it on themselves.
• The 6 digit link code checks that the right device asks; it is not a proof against a dishonest server. The keys stay with your devices only as long as the code incubane.com serves does what is described here.
• Limits: 900 MB and 5,000 items per person. Deleted after 15 January 2027, or at once with "Delete your synced data" on this page.

Team mode details

• For people who went to Rising together. One lead invites colleagues by email. Opening the invite does not join: the colleague first sees what goes to the lead, then chooses "Join and share" or "Not now". Once joined, their part (their role, plan, sessions, notes with their times and slide findings) goes to the lead's kit on its own, and the lead writes one team report. The people they met go only if they tick "Also share the people I met"; badge photos count as people met. A member can change that, pause sharing (which removes what they shared from the team) or leave at any time. In works council terms: nothing flows without the member's own choice, and it can be stopped.
• What Incubane stores: the team name, the email addresses invited, who joined and when, and ciphertext. It sends the invite emails through Resend (see docs/legal/dpa-tracker.md); the email holds the team name, the lead's first name (or their email address when no first name is registered) and a join link, no content and no key.
• Keys: every account has a key pair; its private half is encrypted with the person's own sync key. The team key is made on the lead's device and reaches a member only wrapped for that member's public key (ECDH P-256, AES-GCM 256). Incubane never holds a key that opens a pack or the report.
• The finished report is shared as a team space (below); the link to it is sealed with the team key, so only team members can open it.
• Hosted with the sync data in the EU (eu-west-1). A lead can remove a member (what they sent goes too); a member can leave. Everything is deleted on 15 January 2027, or at once with "Delete your synced data", which also deletes the teams you lead. The team report itself lives in a team space (below), which has its own deletion.
• Limits: 25 people per team, 60 invites a day per lead (counted in a log that deleting a team does not reset), 5 new teams a day. Invites go to work addresses only. The email subject has no free text; the body holds the team name, the lead's first name (or their email address when no first name is registered) and a link.

Team space details

• Hosted on Supabase in Frankfurt (eu-central-1), in Incubane's own project. No accounts.
• The report is encrypted in the browser with AES-GCM 256 before it leaves. The server stores one ciphertext per space, a random IV, a version number and dates. It cannot read the report.
• The key is in the link fragment (#k=...). Browsers never send the fragment to a server. After a link opens, the kit removes the key from the address bar.
• Two kinds of link. An edit link also carries a random write token (&w=...); the server keeps only its SHA-256 hash. A view link has no token, so it can read but never save.
• Saves carry a version number. If a teammate saved first, the kit merges their comments and votes before it writes, so nothing is silently overwritten.
• In "roles" mode, team members' names are replaced by their roles before encryption, like a review file. The people the team met (contacts) and presenters stay in the report; leave them out before sharing if they should not be in the space.
• Deleted 90 days after the last save, so a team that keeps saving keeps its space longer than the 15 January 2027 sync cleanup. "Delete your synced data" does not delete it; anyone with the edit link can delete the space at once.
• No direct table access: the public key can only call four functions (create, read, save, delete). A global cap stops a script from filling the database.
• Supabase keeps standard platform logs (for example IP addresses and request times) for a limited period. Request bodies are ciphertext.
• Limit: anyone who has the link can read the space. Share it like you would share a document link.

People and works councils

• Session data has no speaker or attendee fields. When reading slide photos, the AI lists presenters from title slides and people on conference badges, as printed, and never copies email addresses or phone numbers or describes faces.
• Quick capture has a People tab for conversations, braindates and booth visits. The user types in a name, company and role if they want to, and what was discussed. This is saved on their device and goes into their team's pack files and their outputs (the field guide and the action plan, not the leadership email). With Incubane AI, the people you wrote down go through incubane.com to Claude by Anthropic when you write the report. They are not stored. With your own AI, they go only into your own AI chat. The team space stores it encrypted. Users are asked to write down only what the other person is happy to share.
• Owners the AI writes are roles ("HRIS lead"). In Act the team can pick a person from the team as owner; that is their own content, saved and synced like the rest, and shown by role in roles mode.
• Teams can switch to "roles only", so votes and comments show a role instead of a name, and can switch off the activity feed.

What we ask you to check

• That your company allows the AI tool you pick for slide photos from a conference.
• That forward-looking slides may be used internally. The kit flags them.