Evidence, privacy, and boundaries
A precise account of what Statsly computes, what leaves the device, and what still requires independent validation.
Validation
Automated validation covers supported data shapes, numerical output contracts, and cross-method regression cases. Method pages link primary sources. Statsly is not certified medical software, and consequential analyses require independent statistical review.
Privacy
Browser execution keeps datasets on the device. Server analysis sends the active dataset and analysis specification to the configured server. Optional sync encrypts project archives in the browser before upload; the passphrase is never sent.
Security
Local workspaces use browser storage. Cloud access uses scoped bearer sessions and encrypted transport in production. Administrators must configure HTTPS, secrets, retention, backups, and access logs before enabling cloud use.
Data flow
Data stay in browser storage; analysis runs locally when the method is supported.
The selected version and specification are sent to the configured statistics backend.
Only AES-GCM ciphertext and non-sensitive workspace metadata are stored by the sync service.