CMDash’s own security posture
Every claim below traces to a shipped document, a linked policy, or the catalog it is counted from — the same discipline the product itself runs on. No penetration test has been completed yet, SOC 2 has no signed engagement letter, and the EU stack described on the residency page has not been provisioned — every status below says so directly rather than implying otherwise.
No SOC 2 report and no auditor engaged yet: a readiness self-assessment, not a badge.
The planned scope. No penetration test has been completed or contracted yet.
99.9% target with service credits (Enterprise) — full schedule on /sla
Documents
Data Processing Addendum
Draft version 2026-09 of the GDPR Article 28 terms. No clause is binding until it is reviewed and signed.
VPAT (accessibility conformance)
Voluntary Product Accessibility Template 2.5 — WCAG 2.2 Level AA conformance for all 56 success criteria, generated from the automated axe-core audit and the tracked manual review.
Security overview
Identity, encryption, tenant isolation, HTTP hardening, application security, monitoring, secrets and supply chain — the same claims published at /trust/security.
Architecture one-pager
What runs in production today on AWS Lightsail, component by component, and how CMDash is deployed.
Compliance status
SOC 2 Type II
No SOC 2 report and no auditor engaged yet: a readiness self-assessment, not a badge.
Penetration testing
The planned scope. No penetration test has been completed or contracted yet.
Security overview
Identity, encryption, tenant isolation, the HTTP header set, and RLS enforcement.
Data portability
The export-then-reimport round trip, described — not just promised.
Subprocessors
17 third parties process customer data today, last reviewed 2026-10-09. Every vendor, purpose, data category and legal basis is listed at https://www.cmdash.com/trust/subprocessors.
Data residency
Where regional routing and enforcement exist today: /security/residency.
Status & SLA
Live status
Current component health and incident history — fetched, not asserted.
Service level agreement
Uptime targets and service credits by plan.
Vulnerability disclosure
Scope, safe harbour and the reporting channel: https://www.cmdash.com/trust/disclosure. The same channel is published machine-readably at /.well-known/security.txt (RFC 9116).
Questionnaires
4 pre-filled self-assessments — SIG Lite, CSA CAIQ v4, CSA AI-CAIQ v1.1 and OWASP LLM Top 10. Treat an answer as a starting point, not a commitment.
Still have questions?
Every claim on this page traces back to shipped code, a linked policy, or the catalog it is counted from. See the full procurement pack, or start a trial and verify the rest yourself.