Security, control by control.
Every sentence below is printed from a table in the code, and each one is tied to the control that backs it. A control that is switched off takes its sentence off this page at the same moment. Effective 2026-07-27. Last reviewed against the database as it stands on 2026-09-09.
The review runs on your machine
The Margin Review is not a service you upload a file to. It is code that runs in the browser you opened it in, on a file that never leaves the machine it sits on.
- ›The Margin Review runs in your browser and makes zero network requests. A test poisons every network primitive before the engine loads and fails the build if anything reaches for one, so the review works with the Wi-Fi off.
- ›Names, member identifiers and addresses are replaced with coded references in the browser before any figure is computed, and no name is written into any output. This is not HIPAA Safe Harbor de-identification and Reeve does not claim it is; it is pseudonymization with dates of service retained, because the filing deadlines cannot be computed without them.
What the site itself sends and sets
- ›Every response carries a content security policy with a nonce minted for that request, along with a frame ancestors rule, a referrer policy, a no sniff header and a permissions policy.
Findings, and how they travel
- ›Findings stay in the browser that ran the review. What reaches us is the fact that a run happened, over how many rows, and the totals if you keep them.
- ›A run can be sealed into an encrypted file for a colleague in the same workspace; the file opens only inside that workspace and only with a passphrase, and no server is involved in either direction.
The workspace, and who can do what
- ›A session on this machine ends after thirty minutes without activity, and you are warned one minute before it does.
- ›Every change to people, roles, invitations, settings and runs is recorded in a trail an owner or an admin can read and nobody can edit or delete.
- ›Only an owner can grant or remove the owner role, and the last owner of a workspace cannot be removed. The database refuses it, not the screen.
- ›You can end every session on every device you have signed in from, from the settings page, without waiting for a clock.
What is kept, and for how long
- ›A run covering fewer than five clients records no totals at all, whatever the keep totals setting says.
- ›Run history is kept for the number of days your own workspace sets, and rows past that are removed on the organisation's clock rather than ours.
What a person at Reeve can see
A person at Reeve can see that a run happened, over how many rows, and the totals where your workspace chose to keep them. A person at Reeve cannot see the rows, the client references, the service dates or the findings, because those never leave the browser that produced them.
Reporting something
A security report, or a question from a security review, goes to security@get-reeve.com. That inbox is read by a person.
Collect is money you never captured. Cover is money a payer can still take back.
Reeve reports the two separately and never adds them together, because only one of them is yours to go and get. The Margin Review reads both on your own export and costs nothing.
One pass over your own export, in your browser. The findings are yours to keep, with no obligation.
The recovery lane. Care you delivered and never billed, units short of what was authorized, lines paid under the published rate.
Everything in Collect, plus the exposure lane. Retired codes, authorizations at the end of their period, care delivered past what was approved.
Month to month, no annual contract. Read-only in every tier. Run the free review.
See it work on your own book.
The Margin Review runs on your machine. Load a closed-period export, watch names get replaced with a coded reference locally, and keep the findings.