Privacy
No cookies. No analytics. No accounts. Nothing you enter into the assessment is transmitted anywhere, because there is nowhere for it to go — this site has no backend.
Why this matters more here than on most sites. A completed TID-CMM assessment is a precise description of where an organisation cannot see an attacker. That is exactly the document an adversary would most like to read. It should never be uploaded to a third party, and this tool makes that impossible rather than merely promising it.
What is stored, and where
| What | Where | Leaves your device? |
|---|---|---|
| Your assessment — environment, crown jewels, adversaries, scores, evidence notes | Your browser's localStorage, under the key
tid-cmm-v11 | No |
| Light or dark theme preference | localStorage, key
tid-cmm-theme | No |
| Search queries | Nowhere. The index is downloaded once and matched in memory | No |
| Server logs | Cloudflare records the request metadata any web server sees — IP, time, path, user agent. No account, no cookie, nothing tying requests together | Standard request metadata only |
How to erase everything
Clear site data for this domain in your browser, or use the tool's own Reset control. Both remove the two keys above completely. There is no copy anywhere else to request the deletion of, which is why this site has no data subject request process — it holds no personal data to be the subject of one.
The controls that enforce this, not just claim it
A privacy statement nobody can verify is a promise. These are the mechanisms, all inspectable from your browser's network tab:
connect-src 'self'in the Content-Security-Policy. The page is not permitted to send data to any other origin, so a script that tried would be blocked by the browser rather than by our good intentions. The one request it makes is to this site's own search index.- No third-party resources at all. No fonts, no CDN, no tag manager,
no embedded video.
default-src 'self'forbids them, and a build test fails if one ever appears. Referrer-Policy: no-referrer. Following a link out tells the destination nothing about where you came from.- Share links are plain anchors. Every mainstream share widget is a third-party script that profiles readers on page load whether or not they click. Ours contact nothing until you choose to.
Permissions-Policydenies camera, microphone, geolocation, USB, serial and topics-based advertising interest groups outright.- The offline build. If you would rather not trust any of the above, download the single-file tool and run it with the network off. It is the same tool.
Contact
Security or privacy concerns: hello@tid-cmm.com, or see security.txt. This site is operated by Reza Adineh; there is no company, no processor and no sub-processor.