Security and Trust Statement, Version 2026.10

AccuSights, Inc. and AccuSights LLC

This statement describes, factually, how AccuSights, Inc. and AccuSights LLC (together, "AccuSights") protect the systems and data behind the AccuSights platform, AccuSights Assess, Comply, CMMC Accelerator, AI Governance, Secure Office, Protect and vCISO services. It is informational. It is not a warranty, service-level agreement or contractual commitment; our contractual security obligations to customers are in the Terms of Service, the Protect Services Agreement, the Data Processing Addendum and, where signed, a Business Associate Agreement. Controls change as we improve them, and we update this page when they do.

1. Hosting and infrastructure

The Platform is hosted on Microsoft Azure, primary region East US 2 (United States), with supporting workloads on Amazon Web Services in US regions.
Production, staging and development environments are logically separated. Customer tenants are logically isolated at the application and database layer.
The physical security, environmental controls and infrastructure certifications of Azure and AWS (ISO 27001, SOC 1/2/3, FedRAMP High for applicable services) apply to the underlying data centers; they are Microsoft's and Amazon's attestations, not ours.
Customer Data is stored and processed in the United States unless a customer's Order Form specifies otherwise.

2. Encryption

In transit: TLS 1.2 or higher for all connections to the Platform, portal, APIs and agents; HSTS enforced on public hostnames.
At rest: AES-256 encryption for databases, object storage and backups using cloud-provider-managed keys. Customer-managed keys are not offered as a standard feature.
Secrets and credentials are stored in a managed vault, not in code or configuration files.

3. Identity and access control

Single sign-on (Google, Microsoft) and multi-factor authentication available to all customer users; MFA is required for all customer administrator accounts and for all AccuSights staff.
Role-based access control within each tenant; customers manage their own users and roles.
AccuSights staff access to production and to Customer Data is limited to named personnel with a need to know, granted on a least-privilege basis, reviewed quarterly, and logged. Support access to a customer tenant is time-limited and initiated at the customer's request.
Background checks are performed on personnel with access to Customer Data where permitted by law.

4. Logging and monitoring

Application, infrastructure and authentication events for our own systems are centrally logged, retained for at least 12 months, and monitored 24x7 by the AccuSights Protect SOC — the same service we sell — for anomalous access and threats.
Alerts on privileged actions, failed authentication patterns and configuration changes.
Protect telemetry retention — not a SIEM. AccuSights Protect ingests copies of customer security telemetry and event data solely to detect and respond to threats. Those copies are secondary, read-only working data, retained for 90 days on all tiers and then deleted. AccuSights is not a SIEM, log-management or records-retention service and is not the customer's system of record. Customers remain solely responsible for retaining their own logs and records for the periods required by CMMC/NIST SP 800-171 (AU family), HIPAA, PCI DSS, their insurer, litigation holds or any other obligation. We provide export assistance for data still within the 90-day window on request at our then-current hourly rate, and accept no liability for unavailability of telemetry older than 90 days.

5. Vulnerability management and testing

Continuous SAST, SCA, secrets and infrastructure-as-code scanning in our GitHub-based CI pipeline; dependency updates tracked and applied on a risk-based schedule.
Regular authenticated and unauthenticated vulnerability scanning of production.
Independent penetration test at least annually by a third-party firm, plus testing after major releases; the executive summary is available under NDA on request.
Remediation targets: Critical within 7 days; High within 30 days; Medium within 90 days; Low in the next scheduled release. These are the same targets we commit to contractually.
We run a public Vulnerability Disclosure Policy with safe harbor (accusights.com/legal/vdp).

6. Backups and resilience

Daily encrypted backups of production databases, with geo-redundant copies within the United States.
Restoration tested at least quarterly.
Portal availability target for Protect customers is 99.5% monthly, measured and credited as set out in the Protect SLA Schedule; other services carry no contractual uptime commitment unless an Order Form says so.
Documented business-continuity and disaster-recovery plan, reviewed annually: recovery point objective 24 hours; recovery time objective 8 hours for the platform.

7. Secure development

Code review required for every change; branch protection; signed releases; separation of duties between development and production deployment.
Security requirements and threat modelling for new features, including AI features (prompt-injection and data-leakage controls, output review before customer-facing use).
Our AI providers (OpenAI and Anthropic, under enterprise API terms) are contractually prohibited from training on our customers' inputs or outputs. Customer Data is not used to train AccuSights' or any third party's foundation models, and AI outputs require human review.

8. Vendor and subprocessor management

Every subprocessor that handles Customer Data is risk-assessed before onboarding (security questionnaire and/or SOC 2 / ISO 27001 report review), bound by a written data-processing agreement, and reviewed annually.
Our current subprocessor list is published at accusights.com/legal/subprocessors, with a subscription for change notices and a 30-day objection window for customers.

9. People and training

All staff complete security and privacy awareness training at hire and annually, plus role-specific training for engineers and SOC analysts. Staff sign confidentiality agreements.
Phishing simulations run against our own staff.
Access is revoked on the day of departure.

10. Incident response

Documented incident response plan with defined severity levels, roles, escalation and communication steps; tested with at least one tabletop exercise a year.
Customers are notified of a confirmed Security Breach affecting their Customer Data without undue delay and within the period stated in the DPA (72 hours from confirmation) and, for PHI, as the BAA requires. Notifications include what happened, what data was involved, what we have done and what we recommend.
AccuSights maintains technology errors & omissions and cyber liability insurance with carriers rated A- or better; a certificate of insurance is available on request.

11. Compliance posture (stated carefully)

Our security program is aligned to the NIST Cybersecurity Framework 2.0 and CIS Controls v8.1 and draws on NIST SP 800-53. We use our own Comply platform to manage it.
SOC 2: A SOC 2 Type 1 examination of AccuSights is in progress. AccuSights does not currently hold a SOC 2 report; our controls are aligned to NIST CSF 2.0 and CIS Controls v8.1. We do not describe ourselves as "SOC 2 certified" — SOC 2 is an attestation report, not a certification.
HIPAA: We operate as a business associate only under a signed BAA, and apply the HIPAA Security Rule administrative, physical and technical safeguards to PHI in those engagements. Our HIPAA Compliance Officer and Privacy Officer is Dr. Kashmala Khalid ([email protected], subject "ATTN: HIPAA Compliance Officer"). HIPAA has no certification.
CMMC: AccuSights is not a C3PAO and is not a Registered Provider Organization; it is not affiliated with, endorsed by, or accredited by the Cyber AB or the Department of Defense, and does not certify anyone. We do not accept Controlled Unclassified Information into the standard Platform; CUI-capable enclaves are available on order.
ISO 27001 / PCI DSS: we are not certified against these standards and do not process cardholder data (payments are handled by Stripe).
The live privacy policy's earlier description of an "independently audited information security management program" is withdrawn and replaced by the statements above.

12. Shared responsibility

Security is shared. AccuSights secures the Platform and, for Protect, monitors what you connect. Customers remain responsible for their own users, credentials and MFA, endpoint coverage and agent deployment, patching, backups, configuration of their own systems, the accuracy of evidence they upload, and acting on recommendations and alerts. The shared-responsibility matrix for Protect is an exhibit to the Protect Services Agreement.

13. How to get more detail

Customers and serious prospects can request, under a mutual NDA:

the executive summary of our most recent third-party penetration test;
our SOC 2 report or bridge letter, when available;
completed security questionnaires (SIG Lite or CAIQ); and
our policies index.

Request at [email protected] with subject "ATTN: Security", or through your account manager. We aim to respond within 5 business days.

Report a vulnerability: [email protected], subject "ATTN: Security" · accusights.com/legal/vdp Security incident affecting you as our customer: the 24x7 number in your Protect welcome pack, or [email protected] marked URGENT.

AccuSights Security and Trust Statement