Read this before you trust us.
A sealed product owes you its threat model. This page states plainly what we protect against, what we store, what we delete, what machines read, and where the honest limits are. It is written to be checked, not to reassure.
Status, stated plainly. Pannels is in its founding, hand-run phase: panels are convened by a named human under the written protocol this page describes. Commitments below marked [protocol] are operating practice today; those marked [software] are engineering controls that come online with the product build and will not be claimed as live until they are. This page is versioned in public either way — if a commitment weakens, the diff shows it.
Who we protect you from, in order
1 · The people who know you. The dangerous audience for a hard decision is rarely a stranger — it is the investor-friend, the colleague, the circle with a stake in your answer. So: intake maps who must never learn your panel exists (a hard rule in routing, not a note), every proposed seat carries its conflict flags, and for circle-is-the-problem decisions a fully outside panel exists where even the panel never learns your name.
2 · The strangers on your panel. Redaction — and redaction that attacks itself: before you approve, we show you what a reader could still infer from the redacted text. The first outside reader is a canary: they confirm they can't tell who you are before the panel widens.
3 · Us, and our suppliers. Below.
What we store, and for how long
- Intake recording
- [protocol] Deleted the moment you approve the redacted summary. Not archived, not "soft-deleted." The approved artifacts are the only record.
- Panel contents
- [protocol] Held in access-controlled, panel-scoped storage; [software] encrypted at rest by the database. Per-panel keys — so a breach of one panel is a breach of one panel — remain a stated aim, marked unbuilt until they ship.
- Each seat's view
- [protocol] A seat sees their own thread and the redacted decision only — never other seats' answers, never your identity beyond what you approved.
- After the decision
- [protocol] What persists is what you chose to share: the decision record, the de-attributed digest, the look-back notes.
What machines read — the honest part
Software drafts redactions, clusters answers, and schedules windows — which means our systems process panel text in plaintext. End-to-end encryption, where even we can't read it, is incompatible with the parts that make the product work. We will not pretend otherwise. What we do instead: [protocol] every machine output is a proposal a person approves, and nothing is pasted into a model beyond the single panel at hand; [software] model calls run under contracted zero-retention terms (nothing stored by the provider, nothing ever used for training), enforced at the gateway rather than by habit. No panel is touched by software the founding protocol hasn't named.
The one exception, in full
One thing crosses panel boundaries: a content-free record of service — this person's contributions in this class of decision were confirmed valuable, this many times. No text, no names of deciders, no dates tied to companies. It exists so the right people get asked to sit again. It is the entire routing memory, it is auditable, and this paragraph is its complete description.
What would break us, and what we've done about it
- A leak from a panel
- Every seat accepts a confidentiality covenant tied to their name and their voucher's; a breach burns both, permanently. Sealed panels also mean a leaker holds one thread, not the panel.
- A subpoena
- We store the minimum, delete on schedule, and will notify affected members unless legally barred. What does not exist cannot be produced.
- A breach of us
- Per-panel encryption bounds the blast radius; the response plan is written and rehearsed, and disclosure to affected members is committed, in writing, without weasel words.
- Our own drift
- This page is versioned in public. If a future version weakens a commitment, the diff will show it.
The test we invite: open your browser's network tab on any page of this site. No trackers, no third-party fonts, no analytics beacons. A confidentiality product that spies on its own visitors would be lying about something more important. This one phones no one.