Anonymous use
Conversations without an account live only in your browser. The server keeps aggregate counters and error classes, never message bodies. Requests are protected by bot verification and rate limits.
Plans you make
Plan pages store the company name, the preparer name and title, and the logo you choose to add. They are private by link, never listed, and you can delete them. A plan also stores the answers you gave and a snapshot of the guide steps those answers selected, so the document does not change under you when the guide is updated. A one-way hash of your session is kept while you are not signed in. It is what finds your plan again and lets you claim it after you sign in, and it is the same value other anonymous work is counted against, including the daily limit. It cannot be turned back into your session. Nothing else about the session is kept.
Guide requests
When you ask for a guide or a deeper guide, the server stores the guide it is for, what you chose as missing, the step and the platform and version if you gave them, the text you wrote, the plan it came from if you sent it from a plan, the time, and the same one-way hash of your session. The form asks for no name or email address and refuses text that contains an email address or an access token. Requests are read only to decide what to research next and are never shown on the site.
Answers and provenance
Every corpus-backed statement carries a claim identifier that resolves to a source record with publisher, tier, dates, and locator. Inferences and field reports are labeled as such and never promoted to documented fact.
Accounts and saved work
WarmTransfer signs you in with a single-use link sent to your email address. There are no passwords to store or leak. An account stores your email address, display name, conversations and citations, projects, and uploaded files. Conversations without an account are never stored on the server.
Your personal workspace is private to you. Members of a team workspace can read its shared conversations, projects and files. Workspace uploads are stored on the server and are never added to the shared corpus. Plans can be read by anyone who has their link; account-owned plans can only be changed by that account.
Uploading a file stores it on our server and does nothing else: its contents are not indexed, are not searchable, and are never sent to our model provider. You can add an uploaded document to your workspace's knowledge. Only then is its text extracted, split into passages, and sent to our model provider to compute search vectors; when you ask a question, the passages that match it are sent with that question and cited in the answer under a document marker that is distinct from a corpus citation. Indexed passages are stored per workspace, are searched only for signed-in members of that workspace, and are never added to the shared corpus or used to write articles. Removing a document from knowledge, deleting the file, or deleting the workspace removes its passages and search vectors within minutes; the file itself follows the thirty-day deletion schedule.
Deleting a conversation, a file, or your account removes access immediately. Permanent deletion is scheduled within thirty days; failed storage operations are retried. Account deletion preserves a shared workspace that other owners still manage. Hand over ownership or delete a team workspace before deleting its only owner's account.
Local tools
Local-file reports, Trace Studio, Contact Center script review with Flow Studio and UCCX Script Studio, the bulk upload workbook check, the CUCM Webex Calling readiness check, and the Unity Connection mailbox cleanup report process files in the browser tab. Their routes block fetch, XHR, and WebSocket connections while a file is open; files are not uploaded or sent to AI. Each studio parses its file in a disposable browser worker that is stopped when it answers, fails, or exceeds a five-second deadline, so a malformed file costs you a stopped worker rather than a frozen tab.
Sanitized exports alias identifiers before you download them. SIP, SIPS and TEL identities, display names, host names, IP addresses and telephone-number-like identifiers are replaced by pattern; record-level values such as numbers, queues, agents, devices, gateways and sites are replaced by the field they came from, so a value with no recognisable shape is still aliased. An alias is built from the kind of field a value came from and the value itself: one value your file carries in two kinds of field reads as two aliases, and a value that repeats within one kind reads the same way every time. The mapping is one-way and never leaves your browser. Where a tool offers an export that intentionally includes your own identifiers, the file says so on its face. Review any download before sharing it.
A studio does not open the chat pane, because the pane needs a network connection and a studio route allows none. Where a finding has a corpus article behind it, the studio links out to it; the link carries only the article's own name, never anything from your file.
UCCX AEF files
UCCX Script Studio reads an AEF as inert bytes inside a disposable browser worker. The raw file and filename are not sent to the server, written to logs, or placed in browser storage. Prompt text, values, and decoded strings are discarded in the worker rather than returned to the interface. The worker returns only a bounded structural projection, with counts of string shapes such as how many strings end in .wav but not the strings, and is then terminated. WarmTransfer does not bundle customer AEF files or invoke Java deserialization. Closing the script removes the projection from the interface; only a report you explicitly download is saved to your device.
Local Gateway configuration
The Local Gateway configuration form builds an IOS XE configuration in the browser tab from what you type, including the Control Hub and carrier passwords. Its route blocks fetch, XHR and WebSocket connections and starts no worker. Nothing you type is sent to the server, written to logs, placed in browser storage, or sent to AI, and the password fields ask the browser not to fill in or save them. Reloading or closing the page discards every value; only the text you copy leaves it.
Connected reports
Connected Webex reports currently use a Webex Developer Portal bearer token (personal access token), which is valid for up to 12 hours. WarmTransfer uses it in transient memory for one report retrieval through fixed read-only Metadata and Search requests, clears it after the request, and does not store it. Connected report data stays in the tab for up to 30 minutes. Downloads remain on your device and can contain customer identifiers if you choose record-level export.
When a report starts in chat, the conversation passes only the report setup to Report Studio. Report Studio then asks for the bearer token in its protected credential field; the token does not belong in the chat.
Providers
Model and infrastructure providers are replaceable behind a boundary. Production inference runs on the model provider's paid API tier, under terms that do not use prompts or responses to improve the provider's products; provider logging is limited to abuse detection and legal requirements. Provider credentials live in platform secrets, never in the application.
Contact
Security questions: hello@warmtransfer.net.