Security & OPSEC

EvalsEvolved is a personal career journal: a place for individual service members to record their own past, unclassified accomplishments and turn them into evaluation-ready drafts. It is not an official military system, is not endorsed by the Department of Defense or any service branch, and is not a system of record.

Because our members serve, we design around a simple principle: the safest data is data we never collect. This page explains what we collect, what we deliberately refuse to collect, the controls that screen and protect what you store, and — just as important — what this app is not built to hold.

• No unit names or locations. Your profile records only a generic unit type (e.g. "Small Boat Station"), never which one. Specific unit names aren't accepted, because aggregated unit names could reveal sensitive information.
• No SSN, DoD ID, or EDIPI — we never ask for or store government identifiers.
• No duty locations, addresses, or geolocation. The app does not request or track your position.
• No readiness reporting. Your profile is limited to branch, paygrade, duty status, unit type, and job specialty code — what's needed to build branch-accurate evaluations, and nothing more.

For everything we do collect and how it's used, see the Privacy Policy.

Every log entry is screened server-side before it saves — not just in your browser:

• Hard block, no override: content matching classification markings (e.g. "SECRET//") or precise coordinates (decimal, degrees/minutes/seconds, or military grid references) cannot be saved at all.
• Branch-aware AI review: a second layer flags risky operational detail — future missions, movement timing, capability specifics — and asks you to reconsider before saving.
• Audited overrides: if you choose to save despite a warning, that choice is recorded. The audit trail stores only the category of concern and a cryptographic fingerprint — never the flagged text itself.
• Recurring sweep: entries that reach storage without a screen (for example, offline entries synced later) are re-checked against the same non-negotiable patterns, and you're notified to fix anything found.

• Owner-only by default. Every record type carries per-record access rules enforced by the backend — your logs, events, goals, and qualifications are visible to you alone unless you explicitly share them.
• Sharing is consent-based and revocable. Supervisor and department visibility requires an explicit connection both sides agree to, and you can revoke it at any time.
• Exports and AI features are server-verified. They run against your authenticated account on our backend — access decisions are never left to the browser.

EvalsEvolved runs on the Base44 application platform, which reports SOC 2 Type II compliance and ISO 27001 certification and encrypts data in transit and at rest. Application-level access rules — who can read and write each record — are ours, and we treat them as the core of the product's security, not an afterthought.

Crash reporting is configured to strip personal content (log text, names, emails) before any report leaves your device.

• Export your logs and records at any time.
• Revoke sharing with a supervisor or department whenever you choose.
• Delete your account from Settings — this removes your data from the app.

EvalsEvolved is for past, unclassified accomplishments. Our screening exists as a backstop — but OPSEC starts with you. Never enter:

• Classified information or CUI of any kind, at any level.
• Coordinates, positions, or locations of vessels, aircraft, units, or operations.
• Future missions, deployments, schedules, or movement timing.
• Capability, vulnerability, or readiness specifics.
• Other people's personal information without their consent.

"Completed 14 boardings this quarter" belongs in your log. Where, when exactly, and with what asset does not.

We'd rather tell you plainly what this app is not:

• EvalsEvolved is not a FedRAMP-authorized government system and must not be used for information that requires controlled handling.
• It is not end-to-end encrypted. Features like AI eval drafting and OPSEC screening require our servers to process your text. We do not claim "zero-knowledge" storage, because that would not be true.
• It does not replace official records. Verify everything against official sources before it goes on a real evaluation.

As the app grows, so does our security work — this page will be updated as new protections ship.

Found a vulnerability, or something that worries you? Email adaptiverecordsystems@gmail.com with the details. Security reports get priority review, and we're grateful for them — several of the protections on this page exist because someone spoke up.