How your data moves

From your first answer to your downloaded report: what stays on your device, what is sent, and what Durin keeps.

On your device
Raw configs stay here. Your browser masks secrets before you review what to send.
Graded in memory
Only the facts you approve are sent for grading. Audit inputs are discarded after the result is returned.
Your report, your copy
Add your details after the audit. Verify your email, then download the full report in your browser.

Answering the questionnaire

Your answers and current step are saved in this browser so you can return later. Start over clears them. Raw config files are never saved.
Your answers are sent only when you choose to grade them, as ten answer codes, graded in memory and returned. The report is labelled self-reported.
The server keeps nothing from the answers; a previously verified lead record notes that you completed this mode.

Your browser reads the file with the same code the CLI uses and replaces every secret value first. The raw file never leaves the page.
You see exactly what would be sent. Nothing is sent until you press send.
The website checks the masked facts against a strict schema, removes anything that still looks like a secret, grades them in memory and returns the result. It keeps nothing from the audit.
If you have already verified your email, your lead record notes that you completed this mode. Your overall grade and weakest area are added while the follow-up box remains checked. It starts checked; uncheck it to opt out.

Your browser keeps the masked facts for this tab and draws the report from them with the same code the server used. The reply decides whether you see the full report or the overall grade.
After email verification, an overall-only report checks your session and unlocks here. Its facts are not sent again.
Printing and the HTML and JSON downloads are made in your browser.
"Keep in this browser" stores the masked facts in this browser only. A share link carries them after the # sign, so the server never sees them.

Your email, role, optional company size, consent, marketing choice and campaign source are stored as your lead record.
Our team receives your email, company domain, role and company size by email. This notification contains no verification link or audit results.
Durin emails a link that works once and expires after 30 minutes. The code in it sits after the # sign, the part of an address browsers never send to a server, and only a hash of it is stored.
Opening the link sets a signed cookie that lasts 24 hours and gives you a token for the CLI.

The CLI reads agent configs on the machine and grades them offline. It checks its token without the network.
When you agree, it sends one note that an audit was completed, with its mode and your token. It shows that note first, and never sends it with --offline.
--open puts the masked facts after the # sign of a link to this site; your browser grades them and nothing reaches the server.

The tool shows an example video from YouTube. No video requests are made until you choose to play it.
Playing contacts YouTube’s privacy-enhanced player. YouTube receives your network details and the website origin, but no questionnaire answers or config. Changing screens stops the player.

Cloudflare, which hosts the site, keeps standard request records: method, path and status. Audit addresses never carry tokens or secrets.
Audit pages and requests bypass error tracking, and the audit code writes no logs.
Rate limits count requests per hour under a keyed hash of your IP address or email. Each count is deleted when its hour ends.

Start the assessment. Add your details when you’re ready for the full report.