Zero Server-Side Data by Design

Privacy Policy & Data Stance

Your compliance evaluations, answers, and checklist items never leave your web browser.

1. Core Privacy Architecture: Zero Data Transmission

SOC 2 Gap was engineered with a strict, privacy-by-design architecture: your answers never leave your browser.

Unlike conventional compliance software platforms that require your corporate email, employee count, and cloud infrastructure details to deliver a readiness score, our assessment engine runs 100% client-side in vanilla JavaScript.

  • No database writes or user profile creation.
  • Zero background network requests (no fetch(), XMLHttpRequest, or navigator.sendBeacon()) during assessment execution.
  • No third-party analytics scripts, session replay recorders (e.g. Hotjar, FullStory), or advertising pixels.

2. Local Storage Persistence Specification

To enable seamless resume when you refresh your browser or return later, our tools write structured data exclusively to your local device using standard HTML5 localStorage:

Storage Key Tool Association Data Stored Server Access
soc2_assessment_v1 Readiness Assessment Tool Selected criteria scope, active question index, and numerical maturity answers (0-3 or na). 0% (Client device only)
soc2_checklist_v1 Interactive Checklist Boolean checkbox states for the 47 controls and optional user implementation notes. 0% (Client device only)

This data is accessible only by your web browser when visiting this domain. It is never transmitted across the network. You can delete all stored records at any moment by clicking the "Retake" or "Reset" buttons within the tools, or by clearing your browser cache.

3. Cookie Policy & Consent

SOC 2 Gap uses strictly necessary functional cookies required for core web delivery (such as CDN routing and security headers). We do not set marketing, profiling, or cross-site tracking cookies.

When third-party libraries are loaded (such as SheetJS for client-side Excel exports), they are delivered with strict Subresource Integrity (SRI) hashes and executed purely in memory without cookie exchange.

4. External Affiliate Links

Our comparison pages contain outbound affiliate links to third-party compliance automation software providers (such as Vanta and Drata). When you click these links, you navigate away from SOC 2 Gap to the external provider's website. These links carry standard referral query parameters and rel="sponsored noopener" attributes.

External websites maintain their own distinct privacy policies and practices. We encourage you to review their respective disclosures before providing corporate information to any vendor.

Experience True Browser-Only Security Tools

Launch Readiness Assessment → View Compliance Checklist →

Privacy & Data Handling FAQs

Frequently asked questions about our zero-server transmission architecture.

Do my assessment answers get transmitted to your servers?

No. All scoring calculations, radar chart rendering, and gap prioritization run entirely within your web browser using client-side JavaScript. We never receive, process, or store your assessment responses or checklist states on any server.

What data is stored in my browser's localStorage?

We store two keys strictly for your convenience: soc2_assessment_v1 (which caches your active criteria scope and control maturity responses) and soc2_checklist_v1 (which caches your completed checklist boxes and notes). This allows you to refresh or revisit the site without losing progress.

How do I delete my assessment or checklist data?

You can clear your data at any time by clicking "Retake Assessment" on the assessment dashboard or "Reset All" on the checklist page. Alternatively, clearing your browser's local storage or site cache immediately deletes all saved records permanently.

Does SOC 2 Gap use tracking cookies or third-party pixels?

No. We do not set surveillance cookies, tracking pixels, or user behavior session-recording scripts. The site operates with zero analytics trackers by default.

Can SOC 2 Gap see which vendor comparison links I click?

Outbound vendor links on our comparison pages carry standard affiliate tracking parameters on the vendor's landing page so they know you arrived from SOC 2 Gap. We do not track or record your personal identity, IP address, or internal click path.

Do I need an account or email to use SOC 2 Gap?

No. You will never be asked to create an account, choose a password, or submit your corporate email address to access any tool, checklist, or guide on this website.