Privacy Policy

Who we are and what this covers

GovSecure AI is operated by [LEGAL ENTITY]. This policy covers the govsecure-ai.com website and the GovSecure AI platform. It does not claim compliance with any specific privacy certification or framework; it describes actual practice so your counsel and privacy office can evaluate it.

Data we collect

• Account data — email address, name, role, agency membership, sign-in timestamps, and MFA enrollment status.
• Compliance content — the systems, control implementations, evidence files and metadata (including SHA-256 content hashes), generated documents, and POA&M items your agency creates or uploads.
• Audit records — for material actions and AI interactions: the acting user or API key, IP address, user agent, action, target, and timestamp, stored in an append-only, hash-chained audit log.
• Contact inquiries — name, email, agency name, and message submitted through the contact form.
• Billing data — subscription and entitlement records. Payment is processed by Stripe; we do not store full payment card numbers.
• Cookies and analytics — as inventoried in the Cookie Policy. Analytics scripts load only after you consent.

How we use data

We use this data to operate the platform (authentication, tenant scoping, document generation, evidence management), to enforce plan entitlements and process billing, to maintain security and auditability, to respond to inquiries, and to monitor service health. We do not sell personal data.

AI processing

When you use AI features, relevant compliance context you have submitted (for example control descriptions and evidence metadata) is sent to Anthropic's Claude models to generate control mappings, narratives, gap analyses, and risk suggestions. Outputs are schema-validated and require human review before use. Each AI interaction is recorded in the audit log with its prompt version and token counts, and AI usage is metered against your plan.

Sub-processors

The following third parties process data on our behalf:

• InsForge — managed Postgres database hosting, S3-compatible object storage for uploaded evidence files, and the payments integration layer.
• Stripe — payment processing (receives billing contact and payment details you provide at checkout).
• Anthropic — AI model provider (receives the compliance context described under AI processing).
• Inngest — background job orchestration for scheduled monitoring and processing jobs (receives job event payloads).
• Google (Tag Manager / Analytics) — website analytics, loaded only after you consent to analytics cookies.

A current sub-processor list is available on request via the contact page.

Security measures

• Postgres row-level security enforcing tenant isolation, live in production. 3PAO assessor accounts see only assessments assigned to them.
• Append-only, hash-chained audit logging.
• Evidence uploads are SHA-256 hashed, versioned, malware-scanned, and recorded in an append-only tamper-evident ledger.
• Passwords hashed with bcrypt and checked against known-breach corpora; MFA via WebAuthn passkeys with recovery codes.
• TLS in transit with HSTS preload, a Content Security Policy, and related security headers.

Retention and deletion

Deleting records in the platform is a soft delete: the record is marked deleted and excluded from normal use, but retained because compliance artifacts must remain reconstructable. Audit logs and the evidence ledger are append-only by design and are not rewritten by deletion requests. Purge of soft-deleted data and end-of-contract retention are governed by your ordering document; absent one, data is retained for [RETENTION PERIOD] after account closure.

Your choices

You can review and update account information in the platform, change cookie preferences via the footer link, and contact us to access, correct, or request deletion of personal data (subject to the retention behavior above). We will describe applicable legal rights in the counsel-reviewed version of this policy rather than assert them here.

Changes and contact

Material changes to this draft will be reflected on this page. Contact: [LEGAL ENTITY], [ADDRESS], [email protected], or the contact page.