Security & Compliance
What runs today, and what does not.
There is no customer-facing platform. NextConsensus runs a public site, an intake form, and an internal application used to do the analysis. The system is single-tenant, so SSO, multi-user roles, and tenant isolation have no multi-user surface to govern yet, and SOC 2 has not been started. This page states what runs in production today, so a reviewer can check it rather than take it on faith.
Current status
In place means running in production today. Everything else is named as what it is.
Data handling
The intake form is the only route by which anything reaches us.
What the form collects
- Work email and therapeutic domain
- The transition you are asking about: authority, action, deadline
- The decision context you gave for it
What we do not accept
- PHI, patient data, or any personal health information
- Proprietary or unpublished clinical trial data
- Confidential strategy or internal deliberative documents
- Anything you would not put in a public document
Forecast inputs
- Public sources only: PubMed, FDA labels, guidelines, ClinicalTrials.gov, committee materials
- Captured with retrieval timestamps and source versions
- Nothing non-public enters a registered forecast
Retention
- Intake submissions: 2 years from last contact
- Deletion on request: email [email protected]
- Program-specific retention is set in the agreement, not here
What actually runs
Two separate things, described so a reviewer can check them rather than take them on faith.
This public site
Cloudflare Pages, compiled ahead of time and served from the edge. No application server, no database, no session state. The only thing that accepts input is the intake form.
The intake endpoint
Submissions post to one endpoint that forwards them onward over TLS. Cloudflare Turnstile handles bot filtering. Nothing submitted here reaches a public surface.
The internal application
A Cloudflare Worker with its own storage, used to assemble evidence states and register forecasts. Access is an allowlist of named addresses. It is not exposed to customers and has no customer sign-in.
Source and build
Private GitHub repositories with automated dependency alerts. Builds run from those repositories. Neither contains customer data.
How enterprise controls get added
SSO, multi-user roles, tenant isolation, and SOC 2 were a deliberate architecture decision rather than an oversight. The system has a single operator and no customer sign-in, so there is no multi-user boundary for those controls to enforce. Building the access-control surface before there is something to isolate would document a boundary that does not exist.
Where a program requires any of them, they are scoped and built as part of that program and agreed in writing before it starts. This page changes when a control is running, not when it is promised.
Subprocessors
Two. No third-party model provider is in the path — any inference runs inside Cloudflare, so nothing you submit is sent to an external AI vendor.
- Cloudflare, Inc. — hosting, edge delivery, bot filtering, storage, email transport, and model inference (US/EU)
- GitHub, Inc. — source code and build pipeline; contains no customer data (US)
Any subprocessor added for a program is named in that program's agreement before it processes anything.
Incident response
A written runbook exists and has never been exercised, because there has been nothing to exercise it against. If a security issue affects data submitted through this site, the contact for it is [email protected], and everyone whose submission is affected gets told directly. Notification windows for a running program are set in that program's agreement, where they can be committed to with something behind them.
Documents
What exists, and what does not, via the contact form or [email protected]:
- Draft DPA and BAA templates — available, never executed against a live agreement
- Mutual NDA — available
- Data flow description for the site and intake form — available
- Security questionnaire (CAIQ, SIG Lite, or your own format) — we will complete one, and the answers will look like this page
- SOC 2 report — does not exist