Security & data
Your records stay yours.
We are pre-launch. This page separates what we commit to now from what is on our roadmap. We will not display a certification we don't hold.
| Area | Commitment | Status |
|---|---|---|
| Model training | Your documents are never used to train models. This goes in every agreement. | COMMITTED |
| Human review | CiviClear drafts findings. A person approves each one before it is used. | COMMITTED |
| Evidence and retention | Evidence packages export in open formats you can keep under your records schedule. | COMMITTED |
| Hosting and encryption | U.S. hosting with encryption in transit and at rest. Region and subprocessors published before pilots begin. | IN PROGRESS |
| Retention and deletion | Configurable retention, and deletion on request at the end of a pilot. | IN PROGRESS |
| Assurance | GovRAMP Progressing Security Snapshot, then SOC 2 Type I and an independent penetration test. | PLANNED |
| AI transparency | GovAI Coalition AI FactSheet for the product. | PLANNED |
Report a security issue
Email [email protected]. We acknowledge reports within two business days. Our security.txt lists the same contact.
Questionnaires
We'll complete your security questionnaire as part of any pilot. Ask at [email protected].