Privacy

What happens to your information.

Assessment answers

The AI Prudential Risk Scan processes your detailed selections and findings in your browser. They are not uploaded automatically. “Save to revise later” downloads a local .avowal file that you can reopen at the assessment page; it is not the PDF report. Both files remain wherever you choose to save them. On reopen, answers are retained only where the question's semantic content hash still matches.

Optional aggregate benchmark

After receiving a result, you may select “Contribute anonymous answers” to add the assessment to an optional aggregate benchmark. The button is the contribution action; there is no automatic upload. The contribution contains a benchmark-series key, coded system-context answers and the answer code for every applicable control question. It does not contain the assessment or initiative name, assessment date, review contact, organisation name, findings, evidence or PDF. The server independently recomputes which controls apply and the aggregate result category; it rejects an incomplete or inconsistent answer set.

The website uses each accepted contribution to atomically increment separate aggregate counters for its declared stage in a Cloudflare D1 database. It does not store an individual response or a link between answers from the same assessment. Idea and design contributions remain in separate aggregate counters and do not enter the figures currently published. Published figures combine pilot and production assessments: an overall percentage appears only after at least 30 accepted pilot and production contributions, and each control percentage appears only after that control has at least 30 applicable pilot and production contributions. Exact totals and organisation-level comparisons are not published.

After an accepted contribution, this browser uses localStorage to retain a contribution marker made from the benchmark-series key and the assessment file's locally generated identifier. The marker contains no answers or findings. It helps prevent accidental repeat contribution from the same browser; clearing site data removes it.

Thirty is a minimum display threshold, not a claim of statistical significance. Contributions are voluntary and self-selected, so the percentages are indicative and do not represent all APRA-regulated entities.

Because a contribution is immediately included in combined counters rather than retained as an individual response, it cannot be identified or removed individually afterwards. Do not contribute if your organisation does not permit this processing.

Email enquiries

Email enquiries are handled through email, not this website. Please do not send confidential assessment answers or customer information unless we have agreed an appropriate way to handle them.

Site operation

The site has no behavioural analytics or contact form. Cloudflare may set its __cf_bm security cookie and process basic connection information to deliver the site, distinguish automated traffic and protect the service. This is not used by Avowal for behavioural analytics. Benchmark request bodies are not written to application logs. For privacy enquiries, contact info@avowal.com.au.