Trust & Security
Your contract data is the most sensitive thing you own. We treat it that way.
ClearDCAA stores rate structures, labor distribution, and contract financials for small government contractors. Here is exactly how we protect it — what's live today, what's on the roadmap, and who we share infrastructure with.
Last reviewed: September 1, 2026 · Reviewed quarterly
Live controls
Security controls in production today
Tenant isolation (row-level security)
Every table is scoped by org_id and enforced at the database layer via Postgres Row-Level Security. A user from Org A physically cannot read or write Org B's data — even if application code has a bug.
Encryption at rest & in transit
AES-256 at rest on managed Postgres and object storage. TLS 1.3 for every client and server request. No plaintext data ever touches disk or wire.
Role-based access control
Seven scoped roles: owner, admin, controller, project_manager, timekeeper, employee, auditor. Salary and bill rates are restricted to owner + admin. Role changes are logged.
Immutable audit log
Every approval, rate change, contract modification, timesheet edit, and role grant is written to an append-only audit table with actor, timestamp, and before/after diff. Database triggers reject any attempt to edit or delete an audit record.
Authentication hardening
Passwords checked against the HaveIBeenPwned breach corpus. Optional MFA. Session timeout on inactivity. Password reset tokens expire in 60 minutes.
Hosted on hardened infrastructure
Database on SOC 2 Type II–certified managed Postgres. Edge compute on Cloudflare's global network. Daily automated backups with 7-day point-in-time recovery.
AI rate limiting & no training
AI contract parsing is rate-limited per user (10 calls/hour) and runs through a gateway that does not retain or train on your prompts.
Input validation everywhere
Every server function and webhook validates input with Zod. Webhook endpoints verify HMAC signatures with timing-safe comparison before processing.
Compliance posture
What ClearDCAA helps you comply with
- DCAA SF 1408 pre-award accounting system review
- FAR Part 31 cost principles & unallowable cost tracking
- DFARS 252.204-7012 / NIST 800-171 control mapping (30 controls seeded)
- Timekeeping designed for DCAA audit readiness (daily entry, floor checks, corrections log)
- Incurred Cost Electronically (ICE) model generation
- FAR 52.215-2 audit & records retention
Roadmap
Third-party certifications
Q1 2027
SOC 2 Type I report
In progressQ3 2027
SOC 2 Type II report
PlannedQ4 2027
NIST 800-171 self-attestation (for CUI handling)
PlannedTBD
FedRAMP Li-SaaS (only if federal-direct demand emerges)
EvaluatingWe will never claim a certification we don't hold. Audit reports will be available under NDA when issued.
Subprocessors
Who else touches your data
We use a minimal set of infrastructure providers. We do not share customer data with advertisers, analytics resellers, or AI training datasets.
Provider
Region
Purpose
Supabase (managed Postgres + auth)
US East
Primary database, authentication, file storage
Cloudflare
Global edge
Edge compute, DDoS protection, TLS termination
AI Processing Gateway
US
AI-powered document parsing and receipt screening — no training on customer data.
Your data, your rights
Portability, deletion, and incident response
Full data export
One-click export of every contract, rate, timesheet, and audit record as JSON + CSV. Available from Settings → Export at any time.
Deletion on request
Account deletion purges your org's data within 30 days. Backups roll off within 7 additional days. We will sign a certificate of destruction on request.
72-hour breach notice
If we ever experience a confirmed security incident affecting your data, you will hear from us within 72 hours with scope, impact, and remediation.
Need our security questionnaire response or a signed DPA?
Email info@cleardcaa.com for security questionnaires and compliance documentation requests.