Forge experiment · Health benefits
What will this actually cost?
A health plan hands you a federally standardized benefits summary, and almost nobody can turn that grid of copays, coinsurance, and deductibles into the one number they want: what a specific course of care will cost them. I built a tool that reads the document and does the math, on Cloudflare and in your browser.
A live beta running on sample data. The estimator is a working product, shown here as a build writeup.
Open the live estimator ↗You give it your plan Summary of Benefits and Coverage, the standardized SBC document, and it returns what a given course of care will actually cost: deductible first, then coinsurance or copay, capped at the out-of-pocket max, with plans compared side by side.
How it works
A benefits summary goes in, Workers AI proposes typed cost-sharing facts, and a deterministic function computes the dollars. Nothing is stored.
Key decisions
Built for sensitive data
This tool touches health-plan information, so I built it on one assumption: treat the data as sensitive and give the server as little of it as possible. Three principles shaped every decision, and the next section shows how each is enforced in the code.
Data minimization
The plan document is read in the browser, and identifiers are stripped before anything is sent. The server receives only the cost-sharing text it needs to read, never who you are or what care you are pricing. Less collected is less to protect.
Store nothing
Retention is zero by construction, not by policy. There is no database or object store in the design at all, and a build test fails if one ever appears. Nothing to breach, nothing to leak, nothing to hand over.
Strict by default
Every response carries a full security-header baseline and a per-request nonce CSP, the AI endpoint is rate limited against abuse, and any third-party key stays server side. Defense in depth, so one mistake is not one point of failure.
To be precise: this is privacy by design, not a certification, and it is a beta on sample data. The document is read on your device and identifiers are stripped before anything is sent, the dollar math runs in your browser, and the only call off Cloudflare is a lookup against the public government plan database, which carries nothing about you.
At the edge
Here is how those principles are enforced. The whole thing is one Workers module on Cloudflare, and all of it is verifiable in the code.
One Worker runs first, for every request
The Assets binding is set to run the Worker first, so a single Workers module handles every request, including static files. That is what lets it attach a full security-header baseline and a Content-Security-Policy before anything is served.
A per-request nonce CSP via HTMLRewriter
HTMLRewriter injects a fresh nonce into every script tag on the way out and pairs it with a strict nonce-based CSP. The Worker forces the HTML document to a full 200 with no-store, stripping the caching headers, so a 304 can never pair a stale-nonce body with a fresh-nonce header and break the page under the strict policy.
A locked-down response by default
Every response carries HSTS with preload, nosniff, a no-referrer policy, framing denied, a tight Permissions-Policy, and cross-origin isolation with COOP and CORP. The defaults assume the page will be probed, not left alone.
Native rate limiting, no storage to provision
Two native Rate Limiting bindings guard the endpoints: the AI extraction path at 20 requests a minute, the plan-lookup proxy at 60, both keyed by the connecting IP. No KV to stand up. It fails open in local dev and is enforced in production.
Retention zero, enforced by a test
Nothing is persisted. There is no KV, D1, R2, or Durable Object binding declared, and a test fails the build if a storage binding or a write of user data ever appears. The privacy claim is checked, not just stated.
One call off the platform, and it carries no PII
The optional plan-by-name path proxies the public government plan database (the CMS Marketplace API) through the Worker, so the API key stays server side and never reaches the browser. That request carries no personal data. Everything else in the estimate stays on Cloudflare and your device.
A small supply chain
Zero runtime dependencies. The PDF reader is self-hosted rather than pulled from a CDN, and wrangler is the only build-time dependency. A tight dependency list is what keeps the CSP tight.
The one rule
The model proposes; a pure function decides. Workers AI only ever proposes typed cost-sharing facts, and a plain deterministic function turns those facts into dollars. No model sits in the money path, so the number is reproducible and auditable.
Omit, never default
If the extractor cannot read a value, the tool does not quietly call it zero. It flags the field and withholds the estimate until you confirm it. A cost tool that guesses low is worse than one that asks, and that guardrail is enforced by a test, not just good intentions.
Where it fits
The honest summary
A real product, running on Cloudflare, that reads a standardized benefits document and computes a real out-of-pocket number. The sensitive flow stays on your device and the edge, retention is zero by design, the model proposes and a pure function decides, and the guardrails are locked with tests. Shown here as a build writeup; the extraction internals stay under the hood.
See it run
The live beta on sample data, running on Workers, Workers AI, and native rate limiting.
Built on Cloudflare while prepping for a Solutions Engineer conversation. A live beta on sample data, last updated 2026-06-30.