Trust Portal
What is true today, and the page that shows it
Each line below is something the product does now, or a policy we keep, and each one leads to the page that says how. We list no certificate we do not hold.
What is true today
- Your documents are private to your accountKept in a private area of our servers that is never served over the web, and read back only through the app by people on your account.
- Roles are checked on our serversEvery request is checked against the account and the role of the person making it. A viewer reads and changes nothing.
- Two-step sign-in on every planA code from an authenticator app after the password, a lock after the minutes you choose, and a pause after sign-ins that do not match.
- Encrypted on the wayEvery page and every request is encrypted between your browser and our server.
- Copied every night, and lockedA copy of your account and your work is taken every night and locked with AES-256 before it is kept. A second copy is kept in another place.
- AI only when somebody asksA reading is sent the question and the facts on the screen. AI writing in a proposal draft stays off until the account turns it on.
- Outside services, by what they doEach kind of outside service that touches member data, and what it is given.
- A written plan for incidentsWhat we do when member data may have been reached.
- A way to report a weaknessWhere to write, what is in scope, and the safe harbour we give a reporter who keeps to it.
- Our security questionnaireOur answers to a security questionnaire, shared under a non-disclosure agreement.
Certificates and reports
| Report | Where it stands |
|---|---|
| SOC 2 Type I report | Not held. |
| SOC 2 Type II report | Not held. |
| ISO 27001 certificate and its Statement of Applicability | Not held. |
We hold none of these today, and we say so wherever a buyer might look.
Controlled unclassified information
Do not upload controlled unclassified information (CUI) to the document library, and do not type it into a record. The service does not yet meet the rules for holding it.
The rest of the Trust Portal
- How data is keptWhere documents sit, who can read them, and what goes to an AI model.
- Access controlRoles, two-step sign-in, sessions and the account history.
- Backups and their encryptionWhat the nightly copy holds and how it is locked.
- Incident responseWhat we do when member data may have been reached.
- Vulnerability disclosureHow to report a weakness, and what is in scope.
- Outside servicesThe kinds of service that touch member data.
- Security questionnaireAsk for it, under a non-disclosure agreement.
- Security and privacyThe whole of what is stored, in one page.