Security and privacy

Browser analysis and the local MCP keep source rows on your device. The optional hosted MCP processes uploaded files on Crosstabs servers using temporary, token-protected workspaces. Neither mode requires an account.

The product boundary

  • There are no user accounts or sign-ups. Browser projects remain local; the optional hosted MCP provides temporary server-side project storage, not durable account-based cloud sync.
  • Files imported through the browser analysis app are parsed locally and are not uploaded to Crosstabs. Files explicitly uploaded through the hosted MCP workspace do leave your device.
  • Saved projects use versioned browser IndexedDB when available, with a localStorage compatibility fallback. You control deletion and backups.
  • Portable .ctproj files let you back up or move a project without creating a server copy.
  • The public statistical API accepts only the contingency-table aggregates explicitly included in a request. It does not accept or persist respondent rows or projects.
  • Local MCP tools can analyze data from your own machine without sending project rows to a Crosstabs-operated data plane.

Sharing and exports

  • Aggregate result links put counts, labels, and selected context in a URL fragment. Browsers do not send the fragment to the website in HTTP requests or referrer headers.
  • A complete aggregate result link is still a bearer disclosure: anyone who receives it can read its contents. Fragment encoding is not encryption and links cannot be revoked remotely.
  • CSV exports sanitize cells that spreadsheet software could otherwise interpret as formulas.
  • PDF and XLSX reports include analysis settings and audit metadata so the method travels with the result.
  • Portable project imports verify schema versions, inventory, and SHA-256 checksums before creating a new local copy. Checksums detect changes but do not authenticate the sender.

Operational telemetry

  • Operational logs and error reports must exclude source rows, uploaded files, project contents, prompts, exports, and browser-storage values.
  • Page analytics is disabled on aggregate snapshot routes and strips query strings and fragments before collection.
  • Health and fixed-shape error endpoints may report coarse release, route, browser, and failure-category information needed to operate the public site.
  • Crosstabs does not use telemetry to reconstruct a user identity or a project history.

Your responsibilities

  • Keep a .ctproj backup if the work matters. Browser storage is convenient local storage, not a synchronized or encrypted backup service.
  • Only share aggregate links and exports with people who are allowed to see their contents.
  • Use your organization’s device, browser, and data-handling policy for sensitive datasets.
  • Review methodology and disclosure notes before publishing a result; software cannot replace accountable research judgment.

Hosted MCP access and limits

  • The hosted MCP uses HTTPS and a dedicated service and database. Workspace capabilities protect private operations, uploads, and downloads; no account sign-in is required.
  • Treat the workspace token like a password. Do not publish it, include it in screenshots or support reports, or store it in public client configuration. There is no account-based token recovery.
  • File, storage, job, and service-wide quotas limit resource use. Background jobs have a 30-second execution timeout. These controls are not an independent security certification.
  • Access expires 24 hours after workspace creation. Export needed results first. Active data cleanup and provider backup retention are separate; early workspace deletion does not promise immediate deletion of every backup copy.
  • Only upload data you are permitted to send to Crosstabs and to your selected AI client. Prefer browser-local or local MCP analysis when server upload is not permitted.