Privacy
Privacy Policy
Effective date 2026-09-06Last updated 2026-09-06
This policy explains what TTX Commander records when you run or join a tabletop exercise, why it is recorded, who else processes it, and what you can ask us to do with it. TTX Commander is operated by Qavren Solutions LLC at ttxcommander.com.
Read this first. The text participants type during an exercise — and the scenario material the game master is working from — is transmitted to Anthropic, a third-party AI provider in the United States, so the game master can respond. Exercise text leaves your environment. It is not processed only on our servers. Never put a real credential, a live production secret, real customer personal data, or regulated data into an exercise. See the Acceptable Use Policy.
Who this applies to
There are two kinds of people on the platform, and they are treated differently.
- Facilitators and their organisation. People who hold an account, create sessions, run exercises, and download after-action reports. Accounts are scoped to an organisation.
- Guest participants. The people in the room playing a role. They join from a link the facilitator sends them. They do not create an account, and the platform never asks them for a name, an email address, or any other contact detail.
What we collect, and why
Account data (facilitators only)
Accounts are handled by our own self-hosted identity service, which we operate on our own infrastructure rather than handing to a third party. Sign-in produces a signed token, and the only claims our application reads from it are your user identifier, your role, and your organisation identifier. Those three values are attached to the sessions you create so that the right people — and only the right people — can reach them. Your email address and sign-in credentials live in that identity service, not in the exercise data.
Guest participant data
A join link is a signed, short-lived token that identifies one session and one scenario role, and nothing else. When a guest uses it, the platform knows two things about them:
- the scenario role they were cast into — for example
CISOorLegal; and - the free text they type into the exercise.
We do not collect a guest’s name, email address, or employer. If a participant types identifying information into the exercise itself, that text is stored like any other exercise text, which is one of the reasons the Acceptable Use Policy asks you not to.
Exercise content
An exercise is recorded because the record is the product: it becomes the after-action report. The following is stored against the session:
- participant actions, as free text, attributed to a scenario role;
- injects and non-player-character dialogue generated by the AI game master;
- decisions taken during the exercise and the grades assigned to them;
- an append-only timeline of every event in the exercise, which is the audit trail the report is built from and is not edited after the fact;
- control-coverage claims — which SOC 2 or ISO 27001 control a moment in the exercise exercised — each carrying the identifiers of the timeline events that are its evidence;
- scores against the scenario’s rubric; and
- the generated after-action report, in JSON, .docx, and .pdf form.
Usage metering
Every AI call made for a session is metered: the session identifier, which part of the system made the call, the model name, four token counters, and a timestamp. This is how a session’s cost is calculated and how we tell whether prompt caching is working. No message content is stored in that ledger — it holds counts, not text.
Operational logs
Our servers write ordinary application logs: request and error records, and one line per AI call carrying the same token counters described above. These are used to keep the service running and to investigate faults, and are not used to profile anyone.
Where exercise content goes
The game master is Anthropic’s Claude. To take a turn, the platform sends Anthropic a request containing the game master’s instructions, the scenario material, and a compact snapshot of the current exercise state — which includes recent participant text, the running situation summary, the facts established so far, and the open threads. Two smaller supporting calls (a summariser and a consistency check) receive the same class of material. When you generate an after-action report, the report’s own contents are sent so the prose sections can be written.
In plain terms: everything typed into an exercise should be assumed to reach Anthropic. Anthropic’s handling of that content is governed by its own agreement with us and its own privacy policy. We do not send exercise content to any other AI provider.
Sub-processors
These are the third parties that process data on our behalf in order to run the service.
| Sub-processor | What it does | What it receives |
|---|---|---|
| Anthropic | The Claude API — the AI game master, the summariser, the consistency check, and the report prose. | Participant free text and scenario content, plus exercise state and, on report generation, the built report. |
| Supabase | Managed Postgres. | All stored exercise data and reports. |
| Amazon Web Services | Compute hosting (EC2) for the application. | Everything in transit through the application, plus server logs. |
| Cloudflare | DNS and encrypted ingress to the application. | Connection metadata and requests in transit. |
We will update this list before adding a sub-processor that receives exercise content.
International transfers
Qavren Solutions LLC is established in the United States and the service is hosted in the United States. Our sub-processors are United States providers, and some of them operate globally. If you or your participants are located outside the United States, exercise content — including the free text participants type — is transferred to and processed in the United States. Where a transfer mechanism is legally required, we rely on the standard contractual clauses or equivalent terms in our agreements with each sub-processor.
How long we keep it
- Exercise data and after-action reports persist until the customer asks us to delete them. There is no automatic expiry. An exercise you ran a year ago is still there, because a filed report has to still be there when an auditor asks about it.
- Join tokens expire on their own — four hours after they are minted, by default. An expired link stops working; it cannot be extended, only replaced by a new one.
- Usage metering and operational logs are kept for billing, capacity planning, and fault investigation.
The platform does not currently offer a self-service delete button. Deletion is done by request — write to [email protected] and we will delete the sessions you name.
Your rights
You can ask us to give you a copy of the data held about a session, to export it, or to delete it. Facilitators can export a session themselves at any time by downloading its after-action report. For anything beyond that, write to [email protected]. We will ask for enough information to be sure the request is genuine, and we will respond within the period the applicable law requires.
Where the GDPR or UK GDPR applies, you have rights of access, rectification, erasure, restriction, portability, and objection, and a right to complain to your supervisory authority. In most cases the customer organisation running the exercise is the controller of the exercise content and Qavren Solutions LLC is the processor acting on its instructions; for account data and for operating the service, Qavren Solutions LLC is the controller. If you are a participant, the fastest route is usually through the organisation that invited you.
Where the CCPA or CPRA applies, you have rights to know, to delete, to correct, and to opt out of sale or sharing, and a right not to be discriminated against for exercising them. Qavren Solutions LLC does not sell personal information and does not share it for cross-context behavioural advertising.
Children
TTX Commander is a professional training tool. It is not directed at children, it is not for anyone under 18, and we do not knowingly collect data from anyone under 18. Facilitators must not issue join links to minors. If you believe a minor has used the service, write to [email protected] and we will delete the record.
How we protect it
These are the measures the platform actually implements:
- Organisation scoping. Sessions belong to an organisation. A request from another organisation is answered with “not found” rather than “forbidden”, so the existence of a session is not revealed to people outside it.
- Signed, short-lived guest links. A join token is cryptographically signed, expires by default four hours after it is minted, and is confined to the single session it was created for. A stale or foreign link reaches nothing.
- Reduced visibility for participants. Guests receive a trimmed view of the exercise. Pending injects, the game master’s working state, and the facilitator’s private direction are never sent to a participant device.
- Asymmetric account tokens. Facilitator sign-in tokens are verified against the identity provider’s published public keys, so the application holds no shared signing secret.
- Encryption in transit. Traffic to the service is served over TLS.
- No public database ports. The database is reachable only by the application, not from the public internet.
No system is perfectly secure, and we do not promise that one is. These are controls, not guarantees.
Changes to this policy
If we change this policy we will update the effective date at the top of the page. For a change that materially affects how exercise content is handled — a new sub-processor that receives it, for example — we will tell account holders before it takes effect.
Contact
Qavren Solutions LLC
[ENTITY ADDRESS]
[email protected]