Trust Center
Trust Center.
Zero document custody. We never see your contracts or your CUI.
See exactly what we screen, what we do not, and where our compliance roadmap stands today.
508-aligned refers to build practice against WCAG 2.2 AA, not a completed conformance audit; the accessibility statement records the current posture and its limitations.
Where we stand
What operates today, and what arrives at general availability.
Every claim reads verbatim from one registry. The same registry feeds our subprocessor list.
- TLS in transitPartial: marketing siteUpon GA: Planned for GA
AutoSAM's marketing site uses 256-bit TLS in transit via its hosting provider.
- Encryption at restNot yet operating
AutoSAM does not currently operate any additional data-at-rest storage of its own.
Upon GA: Upon general availability, AutoSAM intends to implement AES-256 encryption for data at rest.
- Infrastructure hostingPartial: marketing siteUpon GA: Planned for GA
Today, the marketing site is hosted on Vercel. Supabase is a planned subprocessor, activated at product general availability.
- SOC 2 postureNot yet operating
AutoSAM (GovCertix LLC) does not currently hold SOC 2 Type II certification. A SOC 2 attestation is on our compliance roadmap and will be pursued once AutoSAM operates a live production environment. Some infrastructure providers we plan to use hold their own SOC 2 Type II reports; certification inheritance is not equivalent to AutoSAM holding certification.
- SAM.gov monitoring cadenceNot yet operatingUpon GA: Planned for GA
Once AutoSAM reaches general availability, it will run automated SAM.gov checks. Exclusion screening will run daily and entity registration status will be polled daily, pulled directly from SAM.gov public APIs, so changes surface as soon as they publish.
- Stripe payment processingNot yet operatingUpon GA: Planned for GA
No payment processing is currently enabled. Stripe is a planned subprocessor and will begin processing payments at product general availability.
- Data residency and backupsNot yet operatingUpon GA: Planned for GA
Upon general availability, AutoSAM intends to store data in a U.S. region, with automated daily backups, 30-day retention, and AES-256 encryption at rest. See the Privacy Policy §6 and the Subprocessors page for the complete statement.
- Incident response windowsNot yet operating
The response-time figures are pre-GA targets, not binding service-level commitments. They apply once general availability is announced in writing. See /legal/sla for the canonical document.
- Application access controlsNot yet operatingUpon GA: Planned for GA
Upon general availability, AutoSAM intends to implement multi-factor authentication (MFA) support, passwordless magic-link flows, row-level security (RLS) enforced at the database layer, role-based access controls for team workflows, admin audit logging for privileged account-level actions, and session-timeout enforcement across application routes.
- PII posturePolicy commitment
As a matter of policy, AutoSAM does not collect Social Security numbers, bank account numbers, or other high-sensitivity personal information. See the Privacy Policy §1 for the full inventory of personal information the site collects today.
Data handling
Zero Document Custody
AutoSAM takes no custody of your documents. There is no document-upload path and no image processing anywhere in the product.
Every mechanism that touches a user document keeps the bytes on your device, or fetches only public data, so your files never reach our servers:
Active-contract clause extraction
Processed entirely in your browser; never transmitted to our servers. Only clause identifiers leave the device.
Subcontractor roster import
Processed entirely in your browser; only validated structured data, never the file itself, is transmitted to our servers.
Solicitation review (Pursue)
Public solicitation text only, fetched by the system, never a file you upload.
Evidence & attestation (Prove)
Attestation plus an integrity hash; artifacts remain in your environment, the same custody model DoD’s own CMMC assessment hashing practice uses.
A citable federal precedent: under 32 CFR §§ 170.17–170.18, CMMC assessors never retain an OSC’s artifacts; only a SHA-256 hash manifest is recorded to eMASS. A hash demonstrates the artifact has not been altered since the recorded timestamp; it is an integrity record, not a copy of your file and not a claim of anonymity.
Best-effort marking scan: an optional client-side scan flags recognized CUI, distribution, and export-control markings before you submit. Because unmarked CUI cannot be reliably detected, this is a best-effort safeguard, never a guarantee, and you remain responsible for classifying your own material.
This is a stronger data-handling posture than most tools offer, but it is not a FedRAMP authorization. AutoSAM is not FedRAMP-authorized. See the Compliance Roadmap below.
The controls
Every layer, documented.
Encryption, application access controls, authentication, and authorization are documented in the status ledger above. Each row states what operates today, what arrives at general availability, and links to the authoritative source.
Infrastructure hosting
- Today, the marketing site is hosted on Vercel. Supabase is a planned subprocessor, activated at product general availability.
- AutoSAM (GovCertix LLC) does not currently hold SOC 2 Type II certification. A SOC 2 attestation is on our compliance roadmap and will be pursued once AutoSAM operates a live production environment. Some infrastructure providers we plan to use hold their own SOC 2 Type II reports; certification inheritance is not equivalent to AutoSAM holding certification.
- Platform failover and managed resilience controls are inherited from the current hosting provider and will be re-scoped once the application infrastructure is operating.
Operational access
- As a matter of internal operating policy, AutoSAM applies the principle of least privilege to production credentials held by GovCertix staff.
Data handling
- As a matter of policy, AutoSAM does not collect Social Security numbers, bank account numbers, or other high-sensitivity personal information. See the Privacy Policy §1 for the full inventory of personal information the site collects today.
- PostHog product analytics is configured with event-hygiene controls; the analytics behavior is described in the Cookie Policy.
- Data-retention windows for operational and audit records will be published in the Privacy Policy §7 once the application data model is operating.
Vulnerability management
- Dependency scanning via Dependabot and routine package maintenance.
- Regular patching for framework and infrastructure dependencies.
- Responsible disclosure contact: security@autosam.io
System status
A public status page is planned for general availability. For status updates today, contact info@autosam.io.
Compliance roadmap
Compliance roadmap
Framework by framework: what is implemented, what is in progress, and what we do not claim.
| Framework / Standard | Status | Evidence |
|---|---|---|
| SOC 2 Type II | On the compliance roadmap | No evidence document published |
| Section 508 / WCAG 2.2 AA | Aligned (VPAT pending) | Accessibility Statement |
| NIST SP 800-171 | Out of scope by design | Privacy §1.5 |
| CMMC Level 1 | Out of scope | No evidence document published |
| FedRAMP | Not authorized | No evidence document published |
| GDPR | Operating consistent with GDPR | Privacy Policy |
Accessibility posture: AutoSAM is built for Section 508 / WCAG 2.2 AA alignment. Keyboard-accessible flows, visible focus states, and contrast-aware components ship today. We have not yet published a third-party VPAT or independent Section 508 conformance report; that work is in progress and tracked on this page. For the in-app accessibility posture, see the security practices section above.
Where your data lives
Data residency and subprocessors
Upon general availability, AutoSAM intends to store data in a U.S. region, with automated daily backups, 30-day retention, and AES-256 encryption at rest. Retention windows for account data will be documented in the Privacy Policy §7 once billing is live at general availability. See the Privacy Policy §6 and the Subprocessors page for the complete statement.
Subprocessors
Customers are notified 30 days before a new subprocessor is added. The 30-day notice window and any objection process are documented in the DPA (§4). Full policy: Subprocessor list.
When something goes wrong
Incident response
AutoSAM maintains an incident response plan covering detection, containment, eradication, recovery, and post-mortem.
The response-time figures are pre-GA targets, not binding service-level commitments. They apply once general availability is announced in writing. See /legal/sla for the canonical document.
Security research
Responsible disclosure
We welcome responsible security research. If you discover a vulnerability, please contact us.
Report a vulnerability
Email: security@autosam.io
For general security questions: security@autosam.io
Disclosure terms: Responsible disclosure policy
Common questions
Frequently asked questions
See the plans, and the agreements behind them.
Founding rates, standard pricing, and every legal document are public. Security and procurement questionnaires go straight to the team that owns the answers.