- Identity
- SAML 2.0, per-organization IdP. No shared identity directory.
- Admin MFA
- TOTP-based two-factor required on administrative accounts.
- Tenant isolation
- Postgres row-level security policies, enforced in the database.
- Audit trail
- Per-action log: user, organization, IP, user agent, outcome, timestamp.
- Score integrity
- Scoring is computed server-side from raw response data; client-submitted scores are never trusted.
- Transport
- TLS 1.2 or higher, enforced.
- CJIS posture
- Pre-hire cognitive scores are not Criminal Justice Information under FBI CJIS Security Policy. We provide your CJIS Security Officer a one-page applicability statement that documents the data flow and answers the boilerplate question without forcing a full attestation.
- Hosting
- US-based infrastructure. Specifics for your data residency requirements available in the procurement packet.
Items not covered here — penetration test cadence, vulnerability disclosure policy, sub-processor list, incident response timing — are in the procurement packet. Send us your standard questionnaire and we'll return it filled out.