What this site processes and what stays in your browser.

The lab stays in your browser

The Audit uses fixed questions and local scoring rules. The embedded invoice and permission exercises use fixed, illustrative examples. Selecting a scenario or checking an answer does not send information to an AI provider. Quick Compare and Test-set mode also run on authored samples while live access is disabled. You can type a short custom prompt, but this site does not send it to a model or generate an answer to it. There are no file uploads.

Lost in the middle, The cost of a workflow and Boundary break also stay in the open page. They use fixed authored outcomes, local arithmetic and synthetic items; none of them sends content to an AI provider or takes an external action.

Your current selections exist only in the open page. The application does not save them to a database, local storage or a user profile.

Optional Audit sharing and downloads

“Copy result link” creates a link containing all ten Audit selections in its URL fragment (the part after #). Anyone with that link and can read the answers. Do not share selections you consider confidential. The link contains no workflow name or identity, and is not a verified record.

The fragment is read in your browser, not sent as part of the HTTP request to this application. Shared links may remain in browser history, your clipboard and services where you paste them. Downloaded summaries are saved by your browser. This site has no central copy to delete or revoke.

Optional test-set sharing

Test-set links contain only selected model identifiers and preset task identifiers in the URL fragment. Custom prompts, answers, grades and keys are omitted. Downloads contain the prompts and answers shown in your report; review them before sharing. Neither sharing a link nor opening one starts a model request.

No application account or advertising

This site does not create a lab account, collect email sign-ups, or use application analytics or advertising trackers. Fonts and images are served with the site. Vercel BotID provides browser abuse checks for protected API routes; its processing is separate from model calls.

The bank agent demo

The bank agent connects to Enable Banking’s sandbox test bank only. Every account, balance and transaction it shows is synthetic; no real bank can be connected. When you connect, this site sets an httpOnly cookie holding a random demo id and stores, for at most 24 hours: that id, the aggregator’s session id, the sandbox bank name and the synthetic account identifiers. Balances and transactions are fetched on demand and never stored. Disconnect deletes the stored entry at once.

If you paste the demo’s MCP address into your own client, the address carries your demo id; treat it like a temporary link. The public MCP endpoint is rate limited with the same rotating, secret-keyed hash of the connection IP used elsewhere on the site. When the chat is enabled, each question and the tool results are sent through Vercel AI Gateway to the selected model under the live safeguards described below; prompts and answers are not logged by this application.

Hosting

Vercel hosts the site and may process connection, security and operational information, including IP addresses, under its own policies.

Read Vercel’s privacy policy (opens a new tab) for its processing practices.

Links to other sites

LinkedIn and the references in field notes have their own privacy practices. Following an external link leaves this site.

The disabled live path

Live model access is disabled. If authorised later, each run sends its task text through Vercel AI Gateway to the selected model provider. Their processing and retention terms apply. This app does not log prompts or responses. The server keeps no persistent copy of your key: an optional AI Gateway key is held in the open tab, sent over HTTPS for a run and used in memory on the server. The key is never put in a download or share link.

The live safeguards use Redis counters and reservations, with model identifiers and aggregate latency. Daily limits use a rotating, secret-keyed hash of the connection IP, not a stored raw IP. Daily counters expire after two days; accounting records after 40 days. These are pseudonymous safeguards, not an account or a prompt history. Hosting providers may separately retain connection logs.

Email capture is not offered. A future implementation would require explicit consent, email confirmation, a working unsubscribe path and updated privacy information before it appears on the site.

Contact

For questions about this personal site, contact Arun Anderson on LinkedIn (opens a new tab).