Security
Our actual posture, stated plainly. SaaS-appropriate, no theater.
- Two modes: the local CLI keeps evidence on your machine; the hosted service stores your readiness state (control statuses, owners, notes, evidence file names) on the service — tenant API keys are stored only as SHA-256 hashes, and billing runs through Stripe.
- Re-initializing a workspace refuses to wipe existing state without --force.
- Generated reports HTML-escape all customer-controlled text.
- No secrets in code; no telemetry in the CLI.
- Report a vulnerability: email us and we'll respond within 2 business days.
What we don't claim: we don't claim certifications we don't hold,
we don't claim "military-grade" anything, and we don't claim a system can't fail — we claim the
specific controls above and a 2-business-day response on reports.