Does TID-CMM use cookies?

The TID-CMM application code sets no cookies. It stores the assessment and theme preference in browser localStorage, which is separate from cookies and is not automatically attached to HTTP requests. Because the site is served through Cloudflare, Cloudflare may set strictly necessary security cookies when relevant protection or challenge services are active.

Is my assessment uploaded anywhere?

The current assessment code contains no upload or submit path for assessment content. Assessment answers are written to browser localStorage and are not included in requests made by the current assessment code. Users can inspect this behaviour in the browser network panel or use the offline single-file tool with networking disabled.

Do you have analytics?

The published TID-CMM application contains no analytics library, tag manager, advertising pixel or third-party analytics script. Cloudflare still processes ordinary request and security metadata when serving and protecting the site.

How do I delete my data?

Resetting the assessment or clearing site data removes the assessment data stored locally by the TID-CMM application. This does not delete ordinary request or security metadata processed by Cloudflare, which is separate from assessment content and is governed by Cloudflare's policies and retention.

Home › Privacy

Privacy

No application cookies. No application analytics. No accounts. The current assessment code contains no upload or submit path for assessment content: what you enter is written to your browser’s own storage and stays there unless you export it. Serving and protecting the pages is a separate matter — Cloudflare, which delivers this site, processes ordinary request and security metadata and may set strictly necessary security cookies. The three layers are kept apart below.

Why this matters more here than on most sites. A completed TID-CMM assessment is a precise description of where an organisation cannot see an attacker. That is exactly the document an adversary would most like to read. It should not be uploaded to a third party, and the tool is built so that it does not do so on your behalf: the current assessment code has no upload or submit path for assessment content, and the behaviour below can be inspected in your browser’s network and storage panels rather than taken on trust. If you would rather not depend on this site at all, use the offline single-file tool with networking disabled.

Three layers, kept apart

Most privacy statements blur three different things into one sentence. They are separated here, because only the first is under this project’s control.

Layer	What it does
1. The TID-CMM application code what is published in this repository and served from this site	Sets no cookies. Contains no analytics library, tag manager, advertising pixel or third-party analytics script. Contains no upload or submit path for assessment content: your answers are not included in any request the current assessment code makes. The requests the pages do make are for this site’s own files — the stylesheet, the script, the icons and, on a search, the search index.
2. Your browser’s `localStorage` on your device, under your control	Holds the assessment (`tid-cmm-v11`) and the light or dark theme preference (`tid-cmm-theme`). `localStorage` is separate from cookies and is not automatically attached to HTTP requests: a page has to read it and send it deliberately, and this one does not. It leaves your device only when you export or copy it yourself.
3. Cloudflare, serving and protecting the site a third party, under its own terms	Processes the ordinary request and security metadata any web server or CDN sees — IP address, time, path, user agent. Cloudflare’s documentation states that its security services may set strictly necessary cookies, naming `__cf_bm` for Bot Management and `cf_clearance` for the Challenge Platform. Whether any particular cookie is set depends on which Cloudflare services are active and on the request; your browser’s storage panel shows what was actually set. None of this is assessment content.

What is stored, and where

What	Where	Leaves your device?
Your assessment — environment, crown jewels, adversaries, scores, evidence notes	Your browser's `localStorage`, under the key `tid-cmm-v11` (see below)	Not by the assessment code — it is read and written locally, and leaves only if you export or copy it yourself
Light or dark theme preference	`localStorage`, key `tid-cmm-theme`	No
Search queries	Nowhere. The index is downloaded once and matched in memory	No
Requests for the pages themselves	This site is served through Cloudflare, which processes the request metadata any web server or CDN sees — IP address, time, path, user agent — under its own terms, and may set strictly necessary security cookies such as `__cf_bm` or `cf_clearance` when its protection or challenge services are active. The application sets no cookie of its own and creates no account	Request metadata, yes — assessment content, no: the current assessment code does not include it in any request it makes

The storage key `tid-cmm-v11`

Your assessment is kept under the browser-storage key tid-cmm-v11. That string is an internal storage-schema identifier, not the model version. The current maturity model is 1.6.0; the key has been left unchanged deliberately, so that an assessment saved by an earlier build is still found and loaded by the current tool. Renaming it would silently orphan work already in people’s browsers, so it is retained for backward compatibility and the model version is recorded inside the saved data instead — every saved assessment and every export carries model_version.

One consequence worth knowing: two copies of the tool served from the same origin share that key. That is why the archived 1.5.0 assessment in the release archive is offered as a download to run locally rather than as a second assessment on this site.

How to erase everything

Clear site data for this domain in your browser, or use the tool's own Reset control. Either removes the assessment data stored locally by the TID-CMM application — the current assessment code does not include assessment content in any request it makes, so no copy of your answers was created by using this site. It does not delete the ordinary request and security metadata Cloudflare processes while serving and protecting the site, which is separate from assessment content and is governed by Cloudflare’s own policies and retention.

The controls, and how to check them yourself

A privacy statement nobody can verify is a promise. These are the mechanisms in the published build, and each can be checked in your browser’s network and storage panels rather than taken on trust:

connect-src 'self' in the Content-Security-Policy the site ships (_headers). Where the deployment sends that header, the browser restricts the page to connections back to this origin. It is a second line, not the argument: the reason assessment content is not sent is that the current assessment code contains no upload or submit path for it, which you can see in the network panel. Whether this deployment actually sends the header is a separate question, and the response headers in that same panel answer it.
No third-party resources in the published pages. No web fonts, no script CDN, no tag manager, no embedded video: every page in this build was loaded during verification and made no request to another origin. default-src 'self' in the shipped policy is the belt to that brace. Cloudflare serving the pages is delivery of this site, not a third-party resource inside it.
Referrer-Policy: no-referrer in the shipped headers. Where the deployment sends it, following a link out tells the destination nothing about where you came from.
Share links are plain anchors. Every mainstream share widget is a third-party script that profiles readers on page load whether or not they click. Ours contact nothing until you choose to.
Permissions-Policy in the shipped headers denies camera, microphone, geolocation, USB, serial and topics-based advertising interest groups.
The offline build. If you would rather not depend on any of the above, download the single-file tool and run it with networking disabled. It is the same tool; with no network there is no request metadata and no CDN in the path at all.

Contact

Security or privacy concerns: hello@tid-cmm.com, or see security.txt. This site is operated by Reza Adineh; no other organisation is involved in it beyond Cloudflare, which serves the pages, and GitHub, which hosts the model repository and the document downloads linked from the resources page. Nothing on this page is legal advice about your own obligations.

Common questions

Does TID-CMM use cookies?: The TID-CMM application code sets no cookies. It stores the assessment and theme preference in browser localStorage, which is separate from cookies and is not automatically attached to HTTP requests. Because the site is served through Cloudflare, Cloudflare may set strictly necessary security cookies when relevant protection or challenge services are active.
Is my assessment uploaded anywhere?: The current assessment code contains no upload or submit path for assessment content. Assessment answers are written to browser localStorage and are not included in requests made by the current assessment code. Users can inspect this behaviour in the browser network panel or use the offline single-file tool with networking disabled.
Do you have analytics?: The published TID-CMM application contains no analytics library, tag manager, advertising pixel or third-party analytics script. Cloudflare still processes ordinary request and security metadata when serving and protecting the site.
How do I delete my data?: Resetting the assessment or clearing site data removes the assessment data stored locally by the TID-CMM application. This does not delete ordinary request or security metadata processed by Cloudflare, which is separate from assessment content and is governed by Cloudflare's policies and retention.