Security Center
Security posture, controls, and evidence for SecurePoint USA.
Built for defense, aerospace, and regulated facilities.
Last reviewed: September 1, 2026
1. Security at a Glance
What we protect
- Visitor PII, ID images (DL, passport, gov IDs), badge photos
- Screening decisions, adjudication records, audit logs
- Site and organization access controls
Core security principles
- Tenant isolation enforced at the database layer (RLS)
- Zero-trust client architecture with no exposed secrets
- Immutable audit logging via database triggers
- Encryption in transit (TLS) and at rest (Provider Managed)
2. Certifications & Compliance Program
| Framework | Status | What we provide today |
|---|---|---|
| SOC 2 Type II | Not certified. Target Q3 2027 | Controls mapped to the Trust Services Criteria. Audit engagement in progress; scope, contracting, and the observation period are still being set, so the target date is not a commitment. |
| ISO/IEC 27001 | Control-informed; no audit planned | Designed with ISO/IEC 27001 control domains in mind and used as a security-program rubric. We are not pursuing ISO/IEC 27001 audit certification at this time. |
| NIST SP 800-171 / CMMC 2.0 L2 | Controls implemented; Level 2 self-assessment posture | Designed and operated with controls adhering to the applicable CMMC Level 2 and NIST SP 800-171 requirements within its defined environment. No C3PAO certification is claimed. Under the current Phase I framework, Level 2 may be satisfied through self-assessment where designated by the applicable solicitation or contract. |
| FedRAMP | Not claimed | No FedRAMP Ready, Authorized, or Certified status is claimed. |
| Penetration testing | Planned | Formal third-party penetration testing is planned; internal security review is ongoing. Contact us for current timelines. |
How we support your security review
- We will sign a mutual NDA to share detailed security documentation.
- We complete vendor security questionnaires (SIG, CAIQ, and custom formats).
- Downloadable security packet, control matrix, evidence map, and subprocessors list below.
- Architecture review calls with our engineering team on request.
Company & legal
- Legal entity: SecurePoint USA LLC, a Washington limited liability company.
- Registered address: 522 W Riverside Ave, Ste N, Spokane, WA 99201.
- Jurisdiction: U.S.-based company; customer data hosted in U.S. regions.
- Procurement details: W-9 and government procurement identifiers are provided during procurement via security@securepointusa.com.
3. Architecture & Trust Boundaries
Architecture Stack
Client Browser → Vercel Edge and API Routes → Supabase Postgres (RLS)
Private Storage Buckets for IDs, photos, evidence, exports.
Trust Boundaries
- Client ↔ Edge: TLS 1.2+ enforced, secure cookies
- Edge ↔ Database: Authenticated service connections, RLS enforced
- Edge ↔ Storage: Private buckets, signed URL access only
4. Multi-Tenant Data Isolation
Database-Enforced RLS
All tenant data is strictly scoped by organization_id columns. Row-Level Security (RLS) policies enforce access control at the database engine level, ensuring data isolation even if application logic fails.
What this means
- Cross-tenant reads are blocked by database policy
- Cross-tenant writes are blocked by database policy
- Policy violations act as a fail-safe against application bugs
Support Access
Super-admin support actions are audit-logged and restricted. We do not access customer data without explicit authorization or incident context.
5. Identity & Access Management
Authentication & Authorization
Session Security
- Cookie Protection: HttpOnly, Secure, SameSite enforced.
- Session Timeout: Configurable per organization.
- Account Lockout: Enforced policy against brute force attempts.
6. Data Protection & Encryption
Encryption
TLS 1.2+ in transit. Provider-managed AES-256 at rest (Supabase).
Signed URLs
Short-lived, time-bounded signed URLs for all asset access. No public buckets.
Retention
Audit logs retained for 10 years (3,650 days) by default. Image and document retention configurable per organization.
7. Audit Logging & Immutability
Audit logs are append-only. Database triggers strictly block `UPDATE` and `DELETE` operations on the `audit_logs` table to ensure chain of custody.
In addition, every audit insert is linked into a SHA-256 hash chain seeded per organization, so any tampering with historical records is cryptographically detectable. Chain integrity is verified on an automated schedule.
What we log
- Auth events (login, logout, lockout)
- Visitor operations (check-in/out, status change)
- Compliance decisions (adjudication, screening hits)
- System events (config changes, exports)
Correction Model
Audit history is never rewritten. Data corrections are recorded as new insert events, preserving the full history.
8. CMMC / EAR / DFARS Control Alignment
SecurePoint Visitor implements the applicable CMMC Level 2 and NIST SP 800-171 controls within its environment, and carries the physical-security, visitor-control, and access-governance workflows used by defense, aerospace, and export-controlled facilities. It has not undergone a C3PAO assessment, and no product on its own makes a customer compliant.
CMMC L2 Control Mapping
| CMMC Control | Feature Mapping |
|---|---|
| PE.L2-3.10.3 | Escort visitors and monitor visitor activity: escort assignment and recording, host verification, zone-access decisions |
| PE.L2-3.10.4 | Maintain audit logs of physical access: who entered, when, under whose escort, with what screening result |
| PE.L2-3.10.1 | Limit physical access to authorized individuals: badge issuance gated on screening result and access eligibility |
| PE.L2-3.10.5 | Control and manage physical access devices: badge issuance, reprint, and status tracking |
| AU.L2-3.3.1 | Create and retain audit logs: append-only logging with database-level UPDATE/DELETE protection and a SHA-256 hash chain |
| AU.L2-3.3.2 | Uniquely trace actions to individual users: actor, action, target, metadata, timestamp on every event |
| AC.L2-3.1.1 | Limit system access to authorized users: RBAC with organization-scoped roles, enforced by row-level security |
| AC.L2-3.1.2 | Limit access to permitted transactions and functions: granular server-side permission model |
| AC.L2-3.1.8 | Limit unsuccessful logon attempts: account lockout, configurable per organization |
| AC.L2-3.1.11 | Terminate a session after a defined condition: session timeout, configurable per organization |
| IA.L2-3.5.3 | Multifactor authentication for privileged accounts: MFA enrollment and enforcement, with re-authentication for super-administrative access |
| SC.L2-3.13.1 | Protect communications at system boundaries: TLS 1.2+ enforced (1.0/1.1 refused), HSTS preload, rate limiting, Content-Security-Policy |
| SC.L2-3.13.16 | Protect confidentiality of data at rest: AES-256 provider-managed encryption, private buckets, short-lived signed URLs. Not FIPS-validated. |
| EAR / deemed export | Visitor identity, nationality or U.S.-person attestations where configured, host verification, zone-access decisions, and auditable records that can support a customer technology-control plan. SecurePoint does not determine license requirements. |
| DFARS support | Organization-scoped access, MFA/RBAC controls, audit history, and visitor-access evidence that may support procedures associated with DFARS safeguarding obligations. SecurePoint is not itself a DFARS certification and does not replace customer CUI-system requirements. |
Export-Control Workflow Support
- Sanctions and restricted-party screening for visitor access (OFAC and BIS enforced by default; additional sources such as DDTC by configuration)
- U.S. person and foreign-person attestation workflow support where configured
- Audited decisions for access to export-controlled areas, technology, or facilities
- Visitor identity, host verification, badge status, and evidence records that may support a customer's EAR deemed-export and DFARS safeguarding procedures
PE Evidence Pack
Download our CMMC Level 2 Physical Security (PE) evidence checklist designed for third-party assessments.
Download CMMC PE Checklist9. API Security & Validation
Schema Validation
Strict Zod validation on all API inputs to prevent injection and malformed data.
Rate Limiting
Protection on sensitive endpoints (auth, check-in, messages) to prevent abuse and DoS.
10. Operational Security
Detailed Monitoring
Error events and performance metrics are logged with organization context. Alerts configured for security anomalies.
Backups & Disaster Recovery
Continuous backups with Point-in-Time Recovery. Documented Business Continuity and Incident Response plans.
Vulnerability Disclosure
Report a security issue to security@securepointusa.com. Scope, what we ask of researchers, and what we commit to are published at /security/disclosure; the contact is machine-readable at /.well-known/security.txt.
11. Downloads & Evidence
FilesArchitecture, controls, and compliance mapping in one packet.
12. IT & Compliance FAQ
Security Contact
security@securepointusa.comFor questionnaires, due diligence, and IT review scheduling.