Privacy & Data Handling
A plain-language, code-accurate description of what UpgradeGuard does with your Priority ERP metadata, your database credentials, and your account. Last updated 10 September 2026.
How UpgradeGuard works, in one paragraph
You install a Search Agent on your own Priority SQL Server. Your browser and that Agent talk to each other through our relay server (sssl.priority.ninja) over an encrypted HTTPS connection — they never connect directly. The Agent reads your environment's metadata, compares it against a clean reference copy of the Priority version you are considering, and sends the result of that comparison back to your browser, which assembles the report locally.
The comparison itself involves no AI
The core of the report — what changed, what is new, what is yours, and how each item is graded — is produced by a deterministic comparison written in code, running inside your own Agent. No AI service is involved in it, and the same inputs always produce the same output.
Ninja Review — the one optional AI step
Ticking the Ninja Review checkbox before generating a report adds a short written summary of your critical findings. Only in that case, and only then, is anything sent to an AI provider — Anthropic (Claude), in the United States. What is sent is deliberately minimal:
- A count and per-type breakdown of your critical items.
- A capped sample (at most 100 items) of object identifiers only — the object's type and name, plus the short, code-generated reason it was flagged (for example: "column type differs").
- Never the source code of your triggers, SQLI programs or procedures, never your table data, and never your credentials.
Leave the box unticked and nothing whatsoever leaves for an AI provider.
Your database credentials
The SQL Server username and password you type are relayed through our server to your Agent in order to open the connection for that session. They are held in memory only, on every side, and are never written to disk or to any database by us. Closing or refreshing the tab discards them.
Your source code — what's stored, and what isn't
Your own environment's metadata — the full definitions and source code of your tables, triggers, SQLI programs and procedures — is never saved on our server as a whole. It is read by the Agent into memory, compared, and discarded when the Agent stops. The report itself is assembled in your browser, and the PDF is generated on your own machine.
So that you can reopen a report later from your Report History, we do store the comparison result that each paid report was built from: for every differing object, its type, its name, its severity, and the short code-generated reason it was flagged. That is findings and identifiers, not source code. One narrow exception: for Critical-severity trigger findings on a small set of major forms, the report shows a side-by-side view of the actual trigger text that changed — when present, that same before/after text is saved as part of the same encrypted report so it's still there if you reopen it later. This is the one case where trigger source (yours, and on an unchanged line, Priority's own) is held on our server; it is never sent to Anthropic (see above) and never part of what feeds Ninja Review. All of it — findings, and this trigger-text exception where it applies — is encrypted at rest and deleted after 12 months, and none of it is the rendered report or PDF itself.
The reference snapshots the comparison runs against are clean, unmodified reference copies of Priority versions, captured in advance by us — never a copy of a customer's environment. They are stored compressed and encrypted at rest.
What we do store
- Your sign-in email address (from Google or Microsoft), the time you last signed in, and your report count and remaining balance — used to identify you and to meter reports.
- A connection log entry each time you connect an Agent: your email, a timestamp, and the Agent ID.
- A report history entry each time a report credit is used: your email, a timestamp, the database type, the two version numbers being compared, and the comparison result described above — so that the report can be reopened, for 12 months.
Third-party sign-in
Sign-in is handled by Google or Microsoft. We receive only your verified email address from them — no password — and nothing is ever posted back to your account. We do not use advertising or third-party analytics trackers on this site.
Our homepage includes a short video embedded from YouTube in its privacy-enhanced mode: YouTube (Google) sets no cookies unless you press play.
Retention, access and removal
Account records and log entries are kept for as long as your account is active. To request a copy of what we hold about you, or to have your account and its records deleted, email priorityninja@gmail.com from the address you signed in with, and we will action it.