Sophie’s commitments

Sophie Well is public infrastructure. These are the eight guarantees Sophie makes about itself. Each one is a sentence of plain English plus an automated check that fails CI on every commit if the rule is violated.

Every check that backs these promises is open source: read them on GitHub.

1. No outbound network calls

Sophie does not call any server, ever. Every calculation runs in your browser. Closing the page or going offline does not change what Sophie can do.

How it is enforced: _headers pins Content-Security-Policy connect-src 'self'. scripts/check-commitments.mjs asserts that shape on every build. View the check →

2. No third-party scripts

Sophie loads no code from anyone else's servers. All JavaScript (and the optional on-device OCR engine's WebAssembly) is part of the page you downloaded, served from this origin.

How it is enforced: _headers pins script-src to 'self' plus 'wasm-unsafe-eval' (which permits only same-origin WebAssembly compilation for the vendored on-device OCR engine, not general eval and not any third-party origin). The grep-check rule and the commitments check both deny any third-party script vendor and forbid 'unsafe-inline', wildcards, and off-origin script sources. View the check →

3. No cookies

Sophie sets no cookies, ever. There is no cookie banner because there is nothing to consent to.

How it is enforced: grep-check denies any cookie-writing API call in source files outside the test suite. View the check →

4. No persistent storage outside an allowlist

Sophie remembers your theme and your offline cache, and nothing else. No identifiers, no usage data, no 'recently used' list, no preferences sync.

How it is enforced: check-commitments.mjs reads scripts/storage-allowlist.json and asserts every localStorage.setItem / sessionStorage.setItem / caches.open uses a key on the allowlist. View the check →

5. No analytics, telemetry, or beaconing

Sophie does not measure you. No analytics, no session recording, no error reporting to anyone else's server, no 'anonymous usage data.'

How it is enforced: grep-check denies a list of analytics / RUM / error-reporting vendor identifiers in any source file. The CSP connect-src self also blocks the network half at runtime. View the check →

6. No AI / LLM dependencies

Sophie has no AI. Every number Sophie shows you is the output of a deterministic formula with a peer-reviewed citation. There is no model, no embedding, no 'AI-assisted' anything. Sophie will never add AI; if it does, it is a fork, not Sophie.

How it is enforced: check-commitments.mjs scans source for AI-vendor substrings in import / require / string-literal contexts, and asserts no AI-vendor package appears in package.json dependencies. View the check →

7. No login, account, or paid tier

Sophie has no login, no account, and no paid features. The site has one tier. It is free. It will stay free.

How it is enforced: grep-check denies auth and paywall vendor identifiers. check-commitments.mjs asserts no auth / paywall package appears in package.json dependencies. View the check →

8. MIT-licensed forever; SBOM published every build

Sophie is MIT-licensed. The license never changes. Every build publishes a Software Bill of Materials listing every runtime file, every source file, and every development dependency. A small number of vendored third-party libraries under /vendored/ carry their own permissive licenses (Apache-2.0, BSD-2, MIT) and ship from the same origin as the rest of the site.

How it is enforced: check-commitments.mjs asserts package.json license === "MIT" and LICENSE first line begins with "MIT License". scripts/build-sbom.mjs runs on every build. Vendored components live under /vendored/<name>/ with their upstream LICENSE and a _vendored.md provenance ledger. View the check →

Vendored third-party components

Sophie's first-party code is MIT-licensed. A small set of third-party libraries are vendored verbatim under /vendored/, pinned at a specific upstream release, and served from the same origin as the rest of the site (no third-party CDN). Each one carries its own upstream LICENSE and a _vendored.md provenance ledger.

  • Mozilla pdf.js (v5.7.284, Apache-2.0) — PDF text extraction for the Prior-Auth Packet Linter. upstream, vendored copy.
  • mammoth.js (1.2.5, BSD-2-Clause) — DOCX text extraction for the Prior-Auth Packet Linter. upstream, vendored copy.
  • tesseract.js (5.1.1 (+ tesseract.js-core 5.1.0, tessdata_fast eng), Apache-2.0) — Optional, user-triggered, fully on-device OCR for scanned PDFs and images in the Prior-Auth Packet Linter. Loads on demand; runs entirely in the tab; no network, no AI service. Same-origin WebAssembly requires the narrow CSP token script-src 'wasm-unsafe-eval' (no general eval, no third-party origin; connect-src 'self' is unchanged). upstream, vendored copy.

Change process

Changing any commitment requires a pull request that updates this page alongside the corresponding automated check. The process is documented in CONTRIBUTING.md. Found a way to bypass one of these checks? File an issue at github.com/clay-good/sophiewell.com/issues.