Security & Trust

Each customer's data lives in an isolated workspace. Database-level access rules prevent members of one workspace from reading, modifying, enumerating or deleting another workspace's controls, evidence, assessments, findings, risks, POA&Ms, reports, members, invitations or audit history — including through direct API or database attempts, not just the interface. This isolation is covered by automated cross-workspace tests.

Four roles govern what each member can do: Admin, Assessor / Compliance Manager, Contributor / Evidence Owner, and Read-Only / Auditor. Permissions are enforced on the server and in the database, not by hiding buttons — for example, a Read-Only / Auditor is rejected if they attempt to upload evidence, change an implementation status, or record an assessment decision by any means. The last remaining Admin of a workspace cannot be removed or demoted.

Evidence files are stored in private storage with no public access. Downloads use short-lived, time-limited signed links issued only to authorized workspace members. There is no anonymous read path to evidence storage.

Every uploaded file enters quarantine and is content-scanned for malware using the Cloudmersive scanning service before it becomes active. Files stay unavailable unless the scan returns a definitive clean result: scan failures, timeouts and indeterminate results fail closed. Each file's SHA-256 hash and scan result are recorded, cannot be edited afterwards, and unscanned or quarantined evidence is never sent to the AI analyst.

Actions in a workspace — sign-ins, invitations, role changes, assessment decisions, evidence lifecycle events, score changes, disposal approvals — are written to an immutable audit trail recording the workspace, actor, action, timestamp and affected object. No role, including Admin, can edit or delete audit records.

Evidence moves through a controlled lifecycle (Active → Retention Expired → Pending Disposal → Disposed). Legal holds, audit holds and preservation links block disposal, and the checks are re-run before any disposal executes. Disposal requires administrator approval; the scheduled background process only classifies items and never destroys anything on its own. When a file is disposed, its content is permanently removed while its record and hash remain for audit history.

The AI analyst can only propose pending recommendations. It cannot change implementation statuses, scores or records by itself. Accepting, modifying or rejecting a recommendation requires an authorized human, and the reviewer, timestamp, evidence and rationale are recorded for each decision.

Workspace invitations use single-use, expiring links bound to a specific email address, workspace and role. Tokens are never exposed to browsers or stored in a readable form. Sign-in supports email verification and optional Google sign-in; weak and known-breached passwords are rejected.

We do not claim FedRAMP, CMMC certification, SOC 2, ISO 27001, DoD authorization, or any government approval or accreditation. The product's scores and readiness indicators are internal assessment-support tools — not government determinations, C3PAO results or SPRS submissions. Independent assessments of our own security posture have not been completed at this stage.

The six legal policies remain unpublished drafts pending attorney review and launch approval. Beta registration remains closed. Real Controlled Unclassified Information (CUI), sensitive government information, sensitive customer data, confidential customer evidence, sensitive regulated data, and production compliance evidence are prohibited. Use synthetic, non-sensitive test data only. AI recommendations are advisory and require human review.

Report security issues and security incidents to security@getcomplypilot.com. Please do not access data that is not yours, and give us a reasonable opportunity to respond before public disclosure.