Trust Center
How CMDash protects customer data
CMDash is a security-and-compliance platform used by CISOs to run their own programs. We hold ourselves to the same posture we help our customers enforce. This Trust Center documents that posture honestly — what we’ve shipped, what we’ve scheduled, and what we have not done. Every claim links to its implementation or policy.
Program principles
Least privilege by default
Role-based access control, per-tenant Postgres row-level security, short-lived access tokens with refresh rotation.
Defense in depth
TLS termination and hardened HTTP headers at two layers, helmet at the application layer. A web application firewall and automated security-anomaly detection are on the roadmap, not shipped yet.
Evidence over claims
Every control in the SOC 2 mapping points to a specific file, test, or runbook. No checklist theatre.
Honest about gaps
Where a control is partial or missing, we say so on the page that describes it.
Browse the Trust Center
Security Overview
CurrentIdentity, encryption in transit and at rest, tenant isolation, monitoring, supply-chain posture.
Read more
Data Portability
CurrentWhat leaves CMDash with you, in JSON and CSV, and the export-then-reimport round trip that proves it — not asserted.
Read more
Subprocessors
CurrentDated list of every third party that processes customer data on our behalf, with region and legal basis.
Read more
Data Processing Addendum
TemplateGDPR Article 28 addendum with Standard Contractual Clauses reference. Executable for any EEA/UK transfer.
Read more
Responsible Disclosure
CurrentScope, safe harbour, contact channel, 90-day coordinated disclosure. No bug-bounty program yet.
Read more
Penetration Testing
PlannedFirst third-party engagement planned, not yet scheduled or contracted. Scope, timeline, and how the summary will be published.
Read more
SOC 2 Type II
In progressNo SOC 2 report exists yet and no auditor is engaged. A per-criterion (CC1–CC9) readiness self-assessment is published today.
Read more
Questionnaires
CurrentPre-filled SIG Lite, CSA CAIQ v4, CSA AI-CAIQ v1.1, and OWASP LLM Top 10 (2025) vendor-security questionnaires. Download the JSON or browse inline.
Read more
Asking us something not covered here
Security reviews, architecture diagrams under NDA, questionnaires (CAIQ, SIG Lite, custom spreadsheets), and anything else that prospect or customer security teams ask for: email security@cmdash.com. We aim for a first response within one business day.