Sophie’s commitments

Sophie Well is public infrastructure. These are the eight guarantees Sophie makes about itself. Each one is a sentence of plain English plus an automated check that fails CI on every commit if the rule is violated.

Every check that backs these promises is open source: read them on GitHub.

1. No background network calls

Every calculation runs in your browser and keeps working offline. The only hosted write is a problem report you deliberately open and send after the dialog explains which context categories apply.

How it is enforced: _headers pins Content-Security-Policy connect-src 'self'. The report Worker validates the same-origin request and stores only a bounded reproduction record. View the check →

2. No third-party code during ordinary use

All calculation code and the optional on-device OCR engine ship from Sophie Well. Cloudflare Turnstile is the one exception and loads only after you open Report a problem.

How it is enforced: _headers allows only 'self', same-origin WebAssembly, and challenges.cloudflare.com for Turnstile. The commitments check rejects every other script or frame origin. View the check →

3. No cookies

Sophie sets no first-party cookies. There is no account, advertising profile, or cross-visit identity.

How it is enforced: grep-check denies any cookie-writing API call in source files outside the test suite. View the check →

4. No persistent storage outside an allowlist

Sophie remembers your theme and your offline cache, and nothing else. No identifiers, no usage data, no 'recently used' list, no preferences sync.

How it is enforced: check-commitments.mjs reads scripts/storage-allowlist.json and asserts every localStorage.setItem / sessionStorage.setItem / caches.open uses a key on the allowlist. View the check →

5. No analytics, telemetry, or beaconing

Sophie does not measure you. No analytics, no session recording, no error reporting to anyone else's server, no 'anonymous usage data.'

How it is enforced: grep-check denies analytics, RUM, session-recording, and error-reporting vendors. The reporting path accepts only an intentional bounded form submission. View the check →

6. No AI / LLM dependencies

Sophie has no AI. Every number Sophie shows you is the output of a deterministic formula with a peer-reviewed citation. There is no model, no embedding, no 'AI-assisted' anything. Sophie will never add AI; if it does, it is a fork, not Sophie.

How it is enforced: check-commitments.mjs scans source for AI-vendor substrings in import / require / string-literal contexts, and asserts no AI-vendor package appears in package.json dependencies. View the check →

7. No login, account, or paid tier

Sophie has no login, no account, and no paid features. The site has one tier. It is free. It will stay free.

How it is enforced: grep-check denies auth and paywall vendor identifiers. check-commitments.mjs asserts no auth / paywall package appears in package.json dependencies. View the check →

8. MIT-licensed forever; SBOM published every build

Sophie is MIT-licensed. The license never changes. Every build publishes a Software Bill of Materials listing every runtime file, every source file, and every development dependency. A small number of vendored third-party libraries under /vendored/ carry their own permissive licenses (Apache-2.0, BSD-2, MIT) and ship from the same origin as the rest of the site.

How it is enforced: check-commitments.mjs asserts package.json license === "MIT" and LICENSE first line begins with "MIT License". scripts/build-sbom.mjs runs on every build. Vendored components live under /vendored/<name>/ with their upstream LICENSE and a _vendored.md provenance ledger. View the check →

Vendored third-party components

Sophie's first-party code is MIT-licensed. A small set of third-party libraries are vendored verbatim under /vendored/, pinned at a specific upstream release, and served from the same origin as the rest of the site (no third-party CDN). Each one carries its own upstream LICENSE and a _vendored.md provenance ledger.

  • Mozilla pdf.js (v5.7.284, Apache-2.0) — PDF text extraction for the Prior-Auth Packet Linter. upstream, vendored copy.
  • mammoth.js (1.2.5, BSD-2-Clause) — DOCX text extraction for the Prior-Auth Packet Linter. upstream, vendored copy.
  • tesseract.js (5.1.1 (+ tesseract.js-core 5.1.0, tessdata_fast eng), Apache-2.0) — Optional, user-triggered, fully on-device OCR for scanned PDFs and images in the Prior-Auth Packet Linter. Loads on demand; runs entirely in the tab; no AI service. Same-origin WebAssembly requires the narrow CSP token script-src 'wasm-unsafe-eval' (no general eval). upstream, vendored copy.

Change process

Changing any commitment requires a pull request that updates this page alongside the corresponding automated check. The process is documented in CONTRIBUTING.md. Found a way to bypass one of these checks? File an issue at github.com/clay-good/sophiewell.com/issues.