How we protect the information our clients — including government agencies — entrust to us. Last updated July 2026.
All client and program data is stored exclusively in the United States, including backups.
TLS 1.2+ in transit with HSTS; AES-256 at rest. HTTPS-only, always.
Row-level security on every table, database-enforced admin rights, and an append-only audit trail.
Certified NYC & NY State M/WBE with a written security program aligned to the NY SHIELD Act and NYC vendor standards.
Our platform runs on enterprise-grade cloud infrastructure: the application is served from Cloudflare's global edge network, and data is stored in a managed PostgreSQL database hosted by Supabase in the United States. Both providers maintain independently audited security programs (SOC 2 Type II and ISO 27001), undergo continuous monitoring, and provide DDoS protection, network isolation, and managed patching.
All data is encrypted in transit using TLS 1.2 or higher — connections are HTTPS-only, enforced with HTTP Strict Transport Security. Data at rest, including database storage and backups, is encrypted with AES-256. Session cookies are encrypted, signed, and scoped with httpOnly and secure flags.
Access to data follows the principle of least privilege. Every database table is protected by row-level security policies, and administrative privileges are granted only through database-enforced allowlists — application code cannot self-escalate. Administrative and participant access to sensitive records is recorded in an append-only audit log, and login endpoints are rate-limited with lockout protections against brute-force attempts.
All client and program data is stored at rest exclusively in the United States, including backups. Requests are served through our edge provider's global network, where processing is transient and in-memory only — no data is persisted outside the US, and regional processing restrictions are available where an engagement requires them. We collect only the information needed to deliver our services, retain it only as long as required by the engagement and applicable law, and dispose of it securely. Program-specific data handled for government engagements is segregated, access-restricted, and handled per the contracting agency's data requirements.
Each is bound by data-protection obligations, maintains its own audited security program, and receives only the minimum data necessary. We review this list before adding any provider.
| Provider | Purpose | Assurance |
|---|---|---|
| Cloudflare | Edge hosting, DDoS protection, TLS | SOC 2 / ISO 27001 |
| Supabase | Database & authentication (US region) | SOC 2 Type II |
| Lovable | Application platform & transactional email | US-hosted |
| PostHog (US Cloud) | Product analytics — marketing pages only | SOC 2 |
| Site analytics — marketing pages only | ISO 27001 | |
| Calendly | Scheduling embeds on booking pages | SOC 2 |
Our site concierge is powered by Google Gemini via the Lovable AI gateway and receives visitor questions only — no account or program data. Analytics and the concierge are excluded entirely from government-program pages.
We maintain a documented incident-response plan with defined roles, severity levels, and escalation paths. In the event of a security incident affecting personal information, we will notify affected individuals and regulators as required by the NY SHIELD Act and New York breach-notification law, and notify contracting agencies in accordance with our agreements — promptly and transparently.
Recovery is rehearsed, not improvised: the plan pairs with tested runbooks for restoration and continuity, backed by point-in-time database recovery.
We welcome good-faith security research. We commit to acknowledging reports promptly, keeping researchers informed, and not pursuing legal action against good-faith research conducted without harm to our users or data. Our machine-readable policy lives at /.well-known/security.txt.
Last updated · July 2026