Trust & Security
Your contract data is the most sensitive thing you own. We treat it that way.
ClearDCAA stores rate structures, labor distribution, and contract financials for small government contractors. Here is exactly how we protect it — what's live today, what's on the roadmap, and who we share infrastructure with.
Last reviewed: September 1, 2026 · Reviewed quarterly
Live controls
Security controls in production today
Tenant isolation (row-level security)
Every table is scoped by org_id and enforced at the database layer via Postgres Row-Level Security. A user from Org A physically cannot read or write Org B's data — even if application code has a bug.
Encryption at rest & in transit
Data at rest is encrypted by our managed database and storage provider. Data in transit is protected using TLS 1.2 or higher.
Role-based access control
Seven scoped roles: owner, admin, controller, project_manager, timekeeper, employee, auditor. Individual employee compensation information is access-controlled based on role. Company labor-category and billing-rate information is available to authorized organization users where required for ClearDCAA workflows. Role changes are logged.
Immutable audit log
ClearDCAA maintains an immutable audit trail for key compliance, security, financial, contract, approval, access-control and administrative activities. Audit records are protected against modification and deletion by normal application users.
Authentication hardening
Passwords checked against the HaveIBeenPwned breach corpus. Optional MFA. Session timeout on inactivity. Password reset tokens expire in 60 minutes.
Hosted on hardened infrastructure
ClearDCAA is hosted on managed cloud infrastructure whose providers maintain their own SOC 2 reports. Edge compute runs on Cloudflare's global network.
AI rate limiting & no training
AI features use server-side, per-user rate limits and run through a gateway that does not retain or train on your prompts.
Input validation everywhere
Every server function and webhook validates input with Zod. Webhook endpoints verify HMAC signatures with timing-safe comparison before processing.
Compliance posture
What ClearDCAA helps you comply with
- DCAA SF 1408 pre-award accounting system review
- FAR Part 31 cost principles & unallowable cost tracking
- DFARS 252.204-7012 / NIST 800-171 control mapping (30 controls seeded)
- Timekeeping designed for DCAA audit readiness (daily entry, floor checks, corrections log)
- Incurred Cost Electronically (ICE) model generation
- FAR 52.215-2 audit & records retention
Roadmap
Third-party certifications
Q1 2027
SOC 2 Type I report
In progressQ3 2027
SOC 2 Type II report
PlannedQ4 2027
NIST 800-171 self-attestation (for CUI handling)
PlannedTBD
FedRAMP Li-SaaS (only if federal-direct demand emerges)
EvaluatingWe will never claim a certification we don't hold. Audit reports will be available under NDA when issued.
Subprocessors
Who else touches your data
We use a small set of service providers to run ClearDCAA. We do not sell customer data or share it with advertisers.
Provider
Region
Purpose
Lovable Cloud
United States
Application backend, database, authentication, and file storage
Cloudflare
Global
Hosting, network protection, and TLS
Lovable AI Gateway
United States
AI request processing using Google Gemini and OpenAI models
Stripe
United States
Payment and subscription billing
Lovable Email
United States
Transactional email delivery
PostHog
United States
Product analytics
Connected accounting systems
Varies by provider
Customer-authorized accounting data connections
Your data, your rights
Portability, deletion, and incident response
Full data export
One-click export of every contract, rate, timesheet, and audit record as JSON + CSV. Available from Settings → Export at any time.
Deletion on request
Account deletion purges your org's data within 30 days. Backups roll off within 7 additional days. We will sign a certificate of destruction on request.
72-hour breach notice
If we ever experience a confirmed security incident affecting your data, you will hear from us within 72 hours with scope, impact, and remediation.
Need our security questionnaire response or a signed DPA?
Email info@cleardcaa.com for security questionnaires and compliance documentation requests.