This is a build-stage prototype, not a finished product. This page states plainly what happens to what you paste in, because that text is usually a third party's confidential audit request.
The auditor's request text you paste, the company name and audit period you enter, the
stack you tick, and the generated evidence plan are stored in a database so the report
page at /r/<id> keeps working after you close the tab. Nothing else is
collected — no accounts, no cookies, no analytics, no file uploads.
The report URL is unlisted but not password-protected: anyone with the link can view that run, including the auditor's verbatim wording and which controls you're missing. Treat the link the same way you'd treat the pasted request itself, and don't share it outside the people who should already see the request.
Runs are kept indefinitely for now — there is no automatic deletion. If you want a run removed, ask whoever gave you this tool to delete it from the database directly.
It never connects to any of your systems — no OAuth, no tokens, no read access to AWS, GitHub, or anything else. It only reasons about where evidence should live and how to pull it; a human still does the pulling.