Data Practices

This page states plainly how the Quiet Departure client portal at client.quietdeparture.com handles your information — where it lives, who can reach it, how it is protected, and how long it is kept. It complements our Privacy Policy with the operational detail. If anything here is unclear, ask us at privacy@sorvantis.com.

• —Account and contact details — your name, email, and optional phone number
• —Authentication records — your two-factor enrollment and session history (never your password in readable form)
• —Engagement content — questionnaire responses, documents you upload, discussion messages, support requests, and appointment bookings
• —Deliverables — the analysis, briefings, and reports prepared for your engagement

Access is enforced at the database layer by row-level security, not merely by the interface. In practice:

• —You — and any authorized household member on your account — can read your own workspace and nothing else.
• —Only the personnel assigned to your engagement can read your workspace; other staff cannot.
• —Administrative access is limited to the smallest number of personnel needed to operate and support the system, under confidentiality obligations.

• —Two-factor authentication is mandatory for every account — staff and client alike.
• —All traffic is encrypted in transit (TLS), and stored materials are encrypted at rest on the drives that hold them.
• —Access is governed by row-level security in the database and re-checked on the server for every request.
• —Analyst workstations are protected by hardware security keys (YubiKeys). Client material is not stored locally on analyst machines — it resides on servers we operate, similarly encrypted, reachable only through VPN.
• —Sessions expire after a period of inactivity and must be re-authenticated.

We keep our provider list short and vet each one. Every provider below processes data only on our instructions and under contractual confidentiality. None of them use your content for their own purposes, and none use it to train AI models.

Some deliverables are drafted with the assistance of large-language-model services — currently Anthropic, OpenAI, and Perplexity — running Quiet Departure’s proprietary analytical frameworks. Before any engagement content is sent to these services, names, addresses, account numbers, and other identifying details are removed; the services receive a de-identified situation, not a person. Transmission is encrypted, and use is governed by business agreements that prohibit training on our content and impose obligations of confidentiality. The analysis and judgments in every deliverable are made by Quiet Departure personnel, not by the model. No engagement content is used for any purpose beyond the preparation of these documents.

We retain your workspace for as long as needed to conduct and conclude your engagement, and afterward only as long as our professional and legal obligations require. When retention is no longer required, engagement content is deleted. You can ask us to close your account at any time; we will honor the request subject to those obligations.

You may ask us to show you the information we hold, correct it, delete it (subject to our retention obligations), or export it. Reach us at privacy@sorvantis.com and we will respond within 30 days.

If we become aware of a security incident affecting your information, we will investigate, contain it, and notify affected clients and any authorities as required by law, without undue delay.

We believe the practices described on this page are appropriate and reasonable for the kind of sensitive information this portal holds, and in line with accepted protection schemes for data of this nature. Clients should understand, however, that the system is built on commercially available services — hosting, storage, delivery, and the providers named above — which may contain defects or flaws of which we are unaware, and which we do not control.

A flaw or failure in one of those providers could result in a breach of information that we did not cause. Where that happens, our obligation is the one stated above — to investigate, contain, and notify you without undue delay — and we will hold the provider to account. We accept responsibility for breaches of your data only where they result from our own direct actions or our demonstrated negligence; we cannot be held liable for failures that originate in systems and services we do not own or operate.

We will update this page — including the provider list — as our practices change, with a new effective date at the top. Questions: privacy@sorvantis.com.