Trust Center

CivStart Trust Center

Security, Privacy & Compliance

Effective Date: October 9, 2026

The role of the local government leader has never been more demanding. In an era defined by rapid technological shifts, evolving public expectations, and economic volatility, the mandate is no longer just to manage — it is to lead through profound complexity. To do so requires trust.

Welcome to the CivStart Trust Center. This space provides transparency in who we are, what we do, and how we do it. We believe that the effectiveness of government is grounded in trust — and that trust starts with us.

CivStart is a secure online environment where public-sector leaders can define real challenges, and where their peers, solution providers, and partners can engage transparently based on genuine intent rather than market hype.

Challenges are anonymized before any vendor or peer sees them. Your identity and contact information are never shared unless you choose to connect.

We maintain a strict no-competitive-disadvantage policy: CivStart prohibits the use of client metrics, structured KPIs, or platform insights to unfairly advantage a competitor or compromise procurement rules.

NIST CSF aligned
US-only data residency & API processing
Encrypted at rest & in transit
SOC 2 in progress
Your identity stays yours — never shared unless you connect

How to read this

Each control is marked with one of two statuses:

Live: Control is in place and operating. CivStart can demonstrate or provide evidence on request.
In Progress: Control is formally scoped and underway. Target completion date is noted where available.

The controls and commitments described in this document reflect CivStart's operational practices as of the effective date. They are not warranties and do not modify the terms of any agreement between CivStart and its clients. This document is subject to change. Material updates will be recorded in the Changelog (Section 8). Continued use of the platform following any update constitutes acknowledgment of the revised Trust Center.

1. Frequently Asked Questions

Do you encrypt data at rest?

Yes. All datastores containing customer data — including S3 buckets and RDS instances — are encrypted at rest using AES-256.

How does CivStart encrypt data in transit?

CivStart uses TLS 1.2 or higher for all data transmitted over public networks. HSTS (HTTP Strict Transport Security) is enforced. Server TLS keys and certificates are managed by AWS and deployed via Application Load Balancers.

Who can see government challenge data?

Your challenge starts private to you. You can share it with your organization so colleagues can see it. Separately, an anonymized signal derived from your challenge enters the matching pool at the outline stage — that is part of using Clarity, and it carries no details that identify you or your government. CivStart staff access is limited to authorized personnel with a documented business need. Challenge data is never used to advantage individual vendors.

Can we request deletion of our data?

Yes. Submit a written request to compliance@civstart.com. Deletion will be completed within 30 days and confirmed in writing.

Is my data used to train AI models?

No. Challenge data processed through our AI providers — Anthropic's and OpenAI's commercial APIs — is not used to train models, and no first-party data enters any model-training pipeline. Both providers retain input and output data for up to 30 days for abuse monitoring. In limited cases where content is flagged for a usage-policy violation, it may be retained longer for safety and legal purposes. CivStart is pursuing Zero Data Retention agreements with both providers to retain only what is technically necessary for a feature to work.

Can vendors see our challenge?

Vendors see an anonymized version: the problem and its context, with your state retained and identifying details removed. They do not see your name, your contact information, or which government you work for. Your identity reaches a vendor only when you, the government user, choose to start a connection.

What does “anonymized” mean?

Anonymized means the details that identify you are removed before anyone outside your organization sees the challenge: your municipality, staff names, internal code references, and other distinguishing details. The state is retained, so the problem stays useful to peers working under the same regulations.

Are our challenges subject to public records / FOIA laws?

In most cases, FOIA is not a concern with the Clarity app. However, the interaction of state and local public-records request rules and laws with AI services is still being figured out in many jurisdictions. Consult with your local attorney or your local AI-use policy.

Can my colleagues see my challenge?

Private by default. You can share a challenge with your organization, which makes it visible to colleagues in your CivStart workspace. You control that setting and can change it.

Is there a minimum before any aggregate is shown?

Yes. No aggregate drawn from government challenges is shown unless it covers at least five distinct government organizations. Below that threshold the aggregate is withheld, not shown with a caveat.

Who owns the output data / the Challenge Statement?

You do. Government users retain ownership of their data and the outputs they create in CivStart, including Challenge Statements. We use your content only to operate and improve the service for you, as described in our Terms of Service and Privacy Policy, and you can export or request deletion of your data at any time.

Do you have cybersecurity insurance?

Yes. CivStart maintains active cybersecurity insurance covering business disruption and data security incidents.

When will SOC 2 Type II be complete?

Our SOC 2 readiness program is active. We are targeting a Type I report in H1 2027 and a Type II audit window in H2 2027. We are happy to share our readiness status and in-scope controls with prospective partners under NDA.

2. Data & Privacy

CivStart collects only what is necessary to operate the platform. Government users retain ownership and control of their challenge data.

2.1 Data we collect

Control	Status	Notes
Customer PII	Live	Name, work email, organization, title — collected at the identity step
Employee PII	Live	Opt-in only
Credit card / payment data	Live	Vendor accounts only, processed by Stripe
Personal health information	Live	Not collected

2.2 Data handling

Control	Status	Notes
Data retention policy established	Live	Documented retention schedules per data class
Customer data deleted upon request	Live	Honored within 30 days of written request
Data classification policy	Live	Internal doc classifying data by sensitivity tier
Data encrypted at rest	Live	AWS S3 + RDS encryption enabled by default
Data encrypted in transit	Live	TLS 1.2+ enforced; HSTS enabled

2.3 Sub-processors

CivStart uses the following third-party sub-processors. All are bound by written data protection agreements. This list is current as of October 9, 2026. CivStart will provide advance notice of material sub-processor changes. Updates are recorded in Section 8 (Changelog).

Control	Status	Notes
Amazon Web Services (AWS)	Live	Primary cloud infrastructure; US regions only
Google Workspace	Live	Business productivity and internal collaboration; US regions only
Stripe	Live	Payment processing; vendor accounts only
SOVRA (Ontopical)	Live	Public-sector data enrichment; unified data-protection parameters
Anthropic	Live	AI model provider for platform intelligence features; API data not used for model training — trust.anthropic.com
Cloudflare	Live	DNS, CDN, and edge network protection for civstart.com
Firecrawl	Live	Web content retrieval for AI-assisted research features; retrieves public web pages only and does not receive user challenge content
OpenAI	Live	AI model provider for platform intelligence features; API data not used for model training — openai.com/policies
Vercel	Live	Application hosting and edge delivery for civstart.com
Clerk	Live	Authentication and session management
SendGrid	Live	Transactional and notification email delivery
PostHog	Live	Product analytics

3. Organizational Security

Control	Status	Notes
Code of conduct policy	Live	Acknowledged by all employees and contractors at hire
Confidentiality agreements	Live	Signed by all employees and contractors at onboarding
Employee background checks	In Progress	Rollout underway for all new hires prior to access provisioning
Password policy enforced	Live	Configured in IdP; minimum complexity and rotation requirements
MFA enforced for remote access	Live	Required for all production system access
Security awareness training	In Progress	Program rollout underway; required within 30 days of hire and annually thereafter
Asset disposal procedures	Live	Certificates of destruction issued for all physical media
Portable media encrypted	Live	Required policy for all removable devices
Anti-malware technology	Live	Deployed and auto-updated across all endpoints
Production asset inventory	Live	Formal inventory of production system assets maintained
Organizational chart maintained	Live	Current org chart with reporting lines documented

4. Infrastructure Security

The controls listed below describe CivStart's current operational practices. They reflect how the platform is built and operated and are maintained on an ongoing basis. They are not contractual warranties. For CivStart's full security posture in a contractual context, refer to the Security Practices clause of your Client Services Agreement.

Control	Status	Notes
Access control policy established	Live	Documents add / modify / remove user procedures
Production access restricted to authorized users	Live	Role-based; requires documented approval
Access revoked on termination	Live	Revocation completed within 24 hours of separation
Unique authentication for production systems	Live	SSH key or unique username + password required
Remote access via encrypted connection only	Live	Approved VPN with MFA gate
Encryption key access restricted	Live	Privileged access limited to authorized personnel
Production database access restricted	Live	Least-privilege access; DBA review required
Firewall in place and configured	Live	Prevents unauthorized access; AWS Security Groups
Network segmentation	Live	Production environment isolated via AWS VPC
Log management in place	Live	Centralized logging; alerts on threshold events
Infrastructure performance monitoring	Live	Automated alerting on predefined thresholds
Intrusion detection system	Live	AWS GuardDuty deployed
Firewall ruleset reviewed annually	In Progress	First scheduled review: Q4 2026
Quarterly access reviews	Live	Quarterly review process in operation

5. Product Security

Control	Status	Notes
No competitive disadvantage use	Live	Strictly prohibits use of client data to advantage competitors
Intent integrity	Live	Government challenge data structured into anonymized signals; no predatory scraping
Vulnerability and system monitoring policy	Live	Formal policy covering vulnerability management and monitoring
Penetration testing	In Progress	Annual third-party pentest scoped; target completion Q1 2027
Automated vulnerability scanning	Live	Quarterly scanning cadence in operation
Control self-assessments	In Progress	Annual self-assessment process defined; first assessment Q4 2026

6. Internal Procedures

Control	Status	Notes
Incident response policy established	Live	Documented and communicated to all authorized users
Security and privacy policies reviewed annually	Live	Review cycle established; next review Q1 2027
Roles and responsibilities documented	Live	Assigned in job descriptions and roles policy
Management roles for information security defined	Live	Oversight responsibilities formally assigned
Change management procedure enforced	Live	All production changes authorized, documented, and tested
Third-party agreements in place	Live	Written agreements with all critical vendors; includes confidentiality obligations
Cybersecurity insurance maintained	Live	Active policy covering business disruption and data incidents
System changes communicated externally	Live	Customers notified of critical changes affecting their processing
External support system available	Live	Users can report failures, concerns, or complaints via compliance@civstart.com
Incident response plan tested annually	In Progress	First test scheduled Q4 2026
Risk management program	In Progress	Threat inventory and risk rating documentation in progress
SOC 2 Type II audit	In Progress	Readiness partner selected; audit window target H2 2027

7. Compliance Frameworks

CivStart designs its security program in alignment with the following frameworks. Formal certification or attestation status is noted for each.

Control	Status	Notes
NIST Cybersecurity Framework (CSF)	Live	Program structure aligned to Identify / Protect / Detect / Respond / Recover
NIST AI Risk Management Framework	In Progress	Alignment assessment underway; target Q4 2026
SOC 2 (AICPA Trust Services Criteria)	In Progress	Readiness platform active; Type I target H1 2027

8. Changelog

This document is versioned. Material changes — including updates to sub-processors, security controls, and compliance status — are recorded here. The sub-processor list in Section 2.3 is current as of the date shown below.

Date	Event
July 1, 2026	Trust Center published. Live controls documented.
October 9, 2026	Consent model updated: an anonymized signal derived from a challenge enters the matching pool at the outline stage. Sub-processors added: OpenAI, Vercel, Clerk, SendGrid, PostHog; the Google Cloud Platform entry corrected to Google Workspace. Intrusion detection, quarterly access reviews, and automated vulnerability scanning moved to Live. Whistleblower policy control removed as not applicable. SOC 2 and penetration test target dates revised.
(Upcoming)	Penetration test completed — date TBD
(Upcoming)	SOC 2 Type I report issued — target H1 2027