Privacy

What you paste is read in your browser and is not sent to us unless you choose to save a register. The tool reads declared values, not documents: a cell of more than 300 characters is replaced with "Content removed" and the line number before anything is shown, and only that scrubbed text is ever sent when you save; any email address in a saved register is removed. When you save, the scrubbed lines and the reading are stored so the product can show them back to you, and are deleted on request or when you close your account. Your email address is stored for sign-in. We do not sell data, run advertising, or share your registers with anyone. Transactional email (sign-in links, receipts) is the only email a saved account receives. Payment details are handled by our payment processor and never touch our systems.

Subcontractors answering a collection link. What you enter on the form goes to the prime contractor named on it, and to no one else. We store your answers, the name and business email you give, and a one-way hash of your network address (never the address itself) to limit repeated sending. The form asks for no CUI, no system security plan and no POA&M detail. To change your answers, send the form again from the same link; to have them deleted, ask the prime or write to us.

For your security reviewer. What is stored: a saved register (the declared values, each cell at most 300 characters, email addresses removed), the answers subcontractors send through a collection link (the values on the form, a name, a business email and a one-way hash of the network address), and the account email. Where: a Supabase database in Sydney, Australia (AWS ap-southeast-2), encrypted at rest, reached only over encrypted connections. Who can see it: a link answer is visible to the prime named on the form and to nobody else; our support staff open a record only to answer a request from its owner. Retention: until the prime deletes the register or closes the account; a subcontractor's answer is deleted on request to the prime or to us. By design the service asks for no CUI, no system security plan, no POA&M detail, no diagrams and no documents, and has no upload. It does not look anything up in SPRS or SAM.

Where it is kept and who can see it. Pages are served by Cloudflare. Saved work and your account are stored in a Supabase database in Sydney, Australia (AWS ap-southeast-2), encrypted at rest and reached only over encrypted connections. Payments are processed by Stripe, and sign-in links and receipts are sent through SendGrid; those four are the only services that handle your data for us. Saved work is kept until you delete it or close your account. Our support staff open a saved record only to answer a request from you.

Questions or deletion requests: support@theartofservice.com.

Subcontractor CMMC Tracker is operated by The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001, Australia.