Security & Trust

Dry Run Ready has no SOC 2, ISO 27001 or similar certification. Scenario scorecards reference NIST and ISO incident phases to show which stage of a response a decision belongs to; that is a teaching aid, not a statement that your organization or ours meets those standards.

• In transit: every connection to Dry Run Ready and from it to its providers uses HTTPS. The voice relay uses a secure WebSocket.
• At rest: data is stored by Supabase under Lovable Cloud and protected by that platform's storage encryption; we have not independently verified the platform's configuration and will link its documentation here once confirmed.
• Tenant isolation: row-level security policies let an account read and write only the organizations, exercises, profile and conversations it owns. Tables that hold other people's addresses or tokens (invitations, participants, report links, plan interest, notification records, logs, the knowledge base) have no browser-side access at all and are reached only through server functions that check who is asking.
• Server boundary: scoring rubrics never reach the facilitator model or the browser during a drill; public report links return only the insurer summary; shared viewers get completed exercises only.
• Secrets: API keys for the AI gateway, email, Telegram and the database live in the hosting platform's secret store. The repository holds only publishable keys.
• Abuse limits: ten drills per hour per network address for anonymous drills, five drills a month per free organization, 30 assistant questions a day per account, and one or three voice trials. Server inputs are validated before any handler runs, and rejected inputs are logged for operators.
• Operators: people who can open the admin dashboard are listed individually in a database table; there is no shared passcode, so every administrative action is traceable to a person.

Lovable (Lovable Cloud: hosting, database, authentication, storage, AI gateway, email sending, browser error reports), Supabase (the database platform under Lovable Cloud), OpenAI and Google (models reached through the gateway), Resend (email, through Lovable Emails), Telegram (alerts, when configured), Zippopotam and the US National Weather Service (weather alerts, when configured), CISA (a public feed; nothing about you is sent). What each receives is tabulated in the Privacy Policy.

In the app you can edit or delete organizations, remove viewers and participants, revoke public report links, delete assistant conversations and stop exercise emails. Exercise records and playbooks can be printed or copied from their pages. For an export of everything we hold about you, or to delete exercises or close your account, email dryrun@airworthyadvisory.com; we respond within 30 days.

Email dryrun@airworthyadvisory.com, or see /.well-known/security.txt. Test only against your own account and data; do not access or change other people's data or disrupt the service; give us reasonable time to fix an issue before disclosing it. We will not pursue good-faith research that follows these rules.

Dry Run Ready reaches OpenAI models (a text model for facilitation, scoring, playbooks, assistant answers and scenario improvement; a live model for voice drills) and a Google embedding model (library retrieval) through Lovable's AI gateway. What is sent in each case is listed in the Privacy Policy. Neither we nor, under our arrangement, the providers train models on your content; we have not yet published the providers' own statements and will add them once verified.

Every chat surface tells you it is an AI before you start. Output is produced live and is not reviewed by us before you see it. Known limits: the facilitator can misread an answer, scoring is an AI judgement against a rubric and can be inconsistent between runs, and the library assistant refuses rather than guesses when nothing in the library matches, which can mean a correct question gets no answer.

This page describes current practice, not a contractual commitment.