Security & operations, honestly

The one-pager for your ops lead · Last updated 2026-07-10 · Ousios LLC

The short version: Composa is a small vendor with a simple architecture — which is a security posture in itself. The assessment runs entirely in your browser; almost nothing is transmitted anywhere; what is transmitted goes to a short, published list of providers. We don't have a compliance department; we compensate with radical specificity about what we do and don't offer. If this page doesn't answer your ops lead's question, email and we will.

Architecture & data flow

Static, client-side app. The assessment and team builder are a single static page — scoring runs in your browser, results persist in your browser's local storage. There is no user database and no login system, because there's nothing to log into.
Two transmission paths, both opt-in: an email you type in (delivered with your result to a private Google Sheet we control, or to Formspree if configured), and consented research responses (same private sheet). Nothing else leaves the page.
No third-party trackers. No ad pixels, no cross-site tracking. If we enable analytics it will be a cookieless, privacy-first provider, named on the privacy page.
Hardened headers. The site ships a strict Content-Security-Policy (connect-src limited to the named endpoints), X-Frame-Options: DENY, nosniff, and a strict referrer policy.

Access & operations

Who has access: one person — the founder. That's the whole access-control list. No contractors, no offshore support team, no "authorized partners."
Account protection: the code and data accounts (GitHub, Google) are protected with two-factor authentication; the hosting account is being brought to the same standard, and this line will be updated when it is.
Change control: the site is version-controlled in git; every change is reviewable history, and the product ships from a reviewed main branch.

Continuity — the question you're actually asking

"What happens if this one-person company disappears?" Fair. The commitment: if Ousios LLC winds down Composa, customers are notified by email, lead and research data is deleted, and anyone with paid deliverables keeps them (they're documents — they don't stop working when a server does). Because results live in your browser and deliverables are files you hold, there is no data-hostage scenario: nothing of yours is locked inside our infrastructure.

Sub-processors

Vercel	Site hosting and CDN (US).
Google	Private spreadsheet storing consented research rows and email leads; Apps Script as the form endpoint (US).
Formspree	Form processing — only if configured as the lead endpoint (US).
Stripe	Payment processing when paid tiers are live — card data never touches Composa (US).

What we are not (yet): no SOC 2 report, no SSO, no custom security questionnaires at scale, no negotiated MSAs. A plain-language data-processing addendum is available on request for teams that need one. If your procurement process strictly requires certifications we don't have, we'd rather tell you now than after a demo — that's most of what this page is for.

Reporting a vulnerability

Found something? Email hello@composa.team with the details — you'll get a human reply within two business days, credit if you want it, and no legal threats for good-faith research. Given the architecture, the interesting surface is small, but we take reports on any of it seriously.