1. Information We Collect

We collect information you provide when creating an account (name, email, organization), assessment-workflow data (NIST SP 800-171 statuses, evidence files, implementation notes), and company details (CAGE code, UEI, contract numbers).

We also collect limited product-usage analytics with autocapture disabled and configured input masking. Analytics is configured to avoid form inputs and page URLs. CMMC Command is not intended or authorized for CUI; do not submit CUI or classified information.

2. How We Use Your Data

Your data is used to provide and secure the assessment-preparation service, including estimated scoring, gap analysis, document drafts, and team collaboration. We do not sell or monetize assessment data. We disclose data to service providers as needed to operate the service and as described below.

3. Data Storage & Security

Platform data is stored with service-provider encryption in transit and at rest. Authentication is handled by a third-party identity provider. Evidence-file access uses generated storage URLs rather than public URLs persisted in application records. These controls do not make the platform appropriate for CUI.

4. Third-Party Services

We use trusted, industry-standard third-party services for the following purposes:

Identity & Authentication: enterprise-grade user management with MFA support
Database & File Storage: managed database and file-storage services with provider security controls
Payment Processing: PCI DSS compliant payment provider
AI-Assisted Drafting: Professional plan only; endpoints are designed to receive control metadata and company name, not uploaded documents. Do not enter CUI or classified information.
Error Monitoring: configured input masking and URL filtering
Product Analytics: anonymized, autocapture disabled
Email Delivery: transactional email service
Job Orchestration: scheduled tasks (deadline alerts, drift checks)
Rate Limiting: no user data stored

5. Data Retention & Deletion

Your data is retained while your account remains active and as needed to operate the service and meet applicable legal or security obligations. You may request account and data deletion by contacting support; we will confirm the scope, applicable retention requirements, and completion status for the request.

6. Contact

For privacy inquiries, contact privacy@cmmccommand.org.