Security program
High Intent Digital is a small, focused team. Our security program follows three principles:
- Least privilege, least data. Only collect and retain what the product requires. Only grant access on need-to-know.
- Documented, auditable, reversible. Every state change we make on behalf of a customer is logged with actor, timestamp, and rationale.
- Public roadmap. Where we don't yet meet a control, we say what we're doing about it and by when.
Our foundational governance framework is ISO/IEC 42001 (Artificial Intelligence Management System), which is also the standard the AIMS Charter product is modeled on. We dogfood our product on our own AI usage.
This page is written to be honest about current state. AIMS Charter is aligned to SOC 2 (Trust Services Criteria 2017/2022) with a SOC 2 Type II audit engagement scheduled for Q1 2027; the attestation report is issued only after the CPA firm completes the observation period. Not yet certified against ISO/IEC 27001 or ISO/IEC 42001. Where we say "aligned to," we mean the control set is designed against the framework's requirements, not that a certifying body or CPA firm has audited us. Full compliance status below.
A note for procurement and security reviewers: if your team is asking whether AIMS Charter can carry an AI Management System evaluation ahead of your own SOC 2 or ISO/IEC 42001 audit, we can. Your Charter's Vendor Scorecard, RACI, Use Case Inventory, and Incident Register produce the artifact set that maps to the AI section of most modern customer questionnaires. Ask us for a mapping.
Data handling
The data AIMS Charter holds is limited to what customers put into the platform to run their own AI governance program. In sensitivity, it's comparable to what a team would keep in a productivity tool like Notion or SharePoint: internal business documentation and B2B contact information. AIMS Charter does not process consumer PII, protected health information (PHI), or payment card data.
| Data category | What we collect | Where it lives | Retention |
|---|---|---|---|
| Account & user profile | Company name, subscription tier, primary contact, per-user work email, name, title, and role | Netlify Blobs (US region, AES-256 at rest) | Life of account + 90 days |
| Charter module content | AI tool inventory, responsibility assignments, notes, signed attestations, uploaded internal policies, and other content the customer chooses to enter | Netlify Blobs, per-account isolation via account slug | Life of account + 90 days |
| Activity log | Every state change: actor, timestamp, event kind, description | Netlify Blobs, per-account JSONL | Life of account + 90 days |
| Session tokens | 256-bit random hex + expires timestamp + email | Netlify Blobs, session store | Deleted on logout or 7-day expiration |
| AI Risk Snapshot responses | The 12 diagnostic answers, computed scores, contact information | Netlify Blobs; contact mirrored to SharpSpring CRM | Life of account or per deletion request |
| Passwords | Never stored in plaintext. PBKDF2-HMAC-SHA512 hash with 16-byte per-user salt, 200,000 iterations. | Netlify Blobs (users store) | Life of account |
Data we do not collect: consumer personal data, financial account information, government-issued identifiers, protected health information (PHI), payment card data, or biometric data. Customers are asked in the Terms of Service not to upload any of the above into the Charter.
Retention & deletion
While your subscription is active
Your account data, Charter contents, activity log, and uploaded documents are retained for as long as your subscription is active. You can export the entire contents of your Charter at any time from within your account. You can also request deletion of specific records at any time by emailing security@highintentdigital.com; we act on written deletion requests within one business day.
When you cancel
Cancellation begins a 90-day retention period. During this window your data remains available for reactivation without loss. After 90 days, your account becomes eligible for permanent deletion and enters our internal deletion queue.
A member of our security team reviews each pending deletion, confirms the cancellation is final, and approves the purge. This human-in-the-loop check exists so a cancellation is never turned into an irreversible action without a second set of eyes. We commit to completing this review and purge within five business days of the 90-day window closing.
On approval, we permanently delete from primary storage:
- Your account record, user profiles, and login credentials
- All Charter module content (AI tool inventory, assignments, notes, signed attestations, uploaded documents)
- Your activity log
- Your AI Risk Snapshot responses stored on our platform (SharpSpring CRM record deleted separately on request)
Backup copies (see next section) are purged on the next backup cycle after primary deletion, then permanently overwritten on subsequent cycles. Anonymized aggregate product usage data may be retained for statistical purposes but cannot be traced back to your account.
Every deletion is logged with the approving admin, timestamp, and the specific records removed. This audit trail is retained separately for our own compliance record and is available on request.
On demand
You do not need to cancel to request deletion. Email security@highintentdigital.com with the account and records to remove; we confirm completion within one business day.
Legal holds
The only exception to the above is a legal hold. Data covered by a subpoena, court order, or active regulatory investigation is preserved for the duration of that obligation. We would notify the affected customer unless prohibited by law.
Backup & redundancy
Uptime & monitoring
Current uptime monitoring relies on Netlify's built-in function logs. A public status page and independent uptime monitoring (Better Stack or Uptime Robot) is on the roadmap for Q1 2027. Error monitoring via Sentry (functions + browser) is targeted for Q4 2026.
Encryption
At rest. All customer data is stored in Netlify Blobs, which encrypts blob contents at rest using AES-256 (managed by Netlify's infrastructure provider). Passwords are additionally salted and PBKDF2-hashed before storage. Even we cannot recover the plaintext.
In transit. All traffic to and from highintentdigital.com and aimscharter.com is served over HTTPS with TLS 1.3, managed by Netlify's edge. HTTP Strict Transport Security (HSTS) is enforced site-wide with a one-year max-age and preload directive. No mixed content is permitted.
Key management. Cryptographic keys for at-rest encryption are managed entirely by Netlify's infrastructure provider. We do not have direct access to encryption keys or the ability to decrypt individual blobs outside the Netlify Blobs API.
Subprocessors
The vendors below process customer data on our behalf. Each has been reviewed against our internal Vendor / Sub-processor Management policy. We notify customers 30 days in advance of adding a new subprocessor that processes customer content, giving customers the option to object.
| Subprocessor | Purpose | Data shared | Region |
|---|---|---|---|
| Netlify Trust center → |
Hosting, serverless functions, object storage (Netlify Blobs), TLS termination, DNS | All customer account and product data | United States |
| Stripe Privacy policy → |
Payment processing, subscription billing, invoicing | Billing name, email, and payment method. AIMS Charter never touches or stores card data. All PCI scope is handled by Stripe. | United States |
| SharpSpring (Constant Contact) Legal center → |
CRM, transactional email tracking, marketing lists | Customer contact information (name, work email, company, title), AI Risk Snapshot scores, campaign engagement events | United States |
| Google (Gmail API via Google Workspace) Privacy policy → |
Transactional email delivery (AI Risk Snapshot PDFs, verification emails, product notifications) | Recipient email address and message content only | United States |
Planned addition (Q1 2027 at the earliest): Anthropic API, for the Certification Agent feature. Data shared would be limited to account context and user queries on a per-write basis. Anthropic's policy is that data submitted via API is not used for model training. Customers will receive 30 days notice before this subprocessor is added.
Access & authentication
| Control | Current state | Status |
|---|---|---|
| Customer password auth | PBKDF2-HMAC-SHA512, 200,000 iterations, per-user random salt (16 bytes). Meets OWASP recommendation. | In place |
| Session tokens | 256-bit random hex (32 bytes, cryptographic RNG). Server-side session store; revoked on logout, server side, not just cleared in the browser. | In place |
| Session timeout | Sessions end after 1 hour of inactivity and after 24 hours regardless of activity. Both figures follow NIST SP 800-63B rev 4 at AAL2. Sarbanes-Oxley sets no session timeout: it is outcome-based, and auditors test whether a documented policy is consistently enforced, which is what this row states. We do not apply the 15-minute idle limit in PCI DSS requirement 8.2.8, because that is scoped to cardholder data environments and AIMS Charter holds no card data (Stripe does). | In place |
| Admin access | Explicit email allowlist via environment variable. All admin actions logged with actor identity. | In place |
| Failed-login rate limiting | Per-IP rate limiting on the login endpoint, in place today. Per-email limiting, which also slows an attacker spread across many addresses, is on the roadmap for Q1 2027. | Per-IP in place; per-email Q1 2027 |
| HttpOnly session cookies | Migration from browser session storage to HttpOnly + Secure + SameSite=Strict cookies with __Host- prefix. |
Target Q1 2027 |
| Self-service password reset | Email-based reset link, with the request and the completion as separate audited steps. | In place |
| MFA (admin) | TOTP-based MFA for admin logins. | Target Q1 2027 |
| MFA (customer) | Customer-account MFA (Extended tier and above). | Target Q2 2027 |
Application security controls
The following are in effect site-wide as of 2026-07-24:
- HTTP Strict Transport Security (HSTS):
max-age=31536000; includeSubDomains; preload - Clickjacking prevention:
X-Frame-Options: DENYandframe-ancestors 'none'in Content Security Policy - MIME sniffing disabled:
X-Content-Type-Options: nosniff - Content Security Policy restricting script, style, font, image, and connect sources
- Referrer policy locked to
strict-origin-when-cross-origin - Powerful browser features denied by default via Permissions-Policy (camera, microphone, geolocation, payment, USB, Bluetooth, MIDI, sensors)
- Cross-Origin-Opener-Policy set to
same-origin - All traffic TLS 1.3 (Netlify-managed edge)
- Every state-changing action logged in per-account activity register with actor, timestamp, and description
Incident response
A security incident is any event that could compromise the confidentiality, integrity, or availability of customer data, or the operations of the AIMS Charter platform.
Detection. Currently: manual review of Netlify Function logs plus customer report. Formal monitoring and alerting is on the roadmap for Q1 2027, alongside the error monitoring and status page under Backup & redundancy.
Response commitments on confirmed incident affecting customer data:
- Contain within 4 hours of detection
- Notify affected customers by email within 24 hours with what we know
- Provide follow-up detail within 72 hours: root cause, remediation, prevention
Reporting a security concern. Email security@highintentdigital.com with subject line "Security." We acknowledge within one business day. We don't currently offer a bug bounty, but we credit responsible disclosures (with permission) after remediation.
Compliance status & frameworks
We operate a revenue-gated compliance program. Everything we can build at zero external cost (policies, controls, evidence, response processes) is in effect today. External audit engagement (Vanta + auditor + pen test) triggers when a paying customer requires it, MRR reaches a threshold, or a specific enterprise deal enters procurement. This keeps compliance spend proportional to demonstrated demand while leaving us questionnaire-ready.
| Framework | Current status | Type |
|---|---|---|
| ISO/IEC 42001 (AI Management System) | Product is modeled on ISO/IEC 42001. Self-attestation of alignment in progress. Formal alignment doc target Q4 2026. Accredited certification post-first-enterprise deal or 2027 (whichever first). | Aligned |
| NIST AI RMF 1.0 + GenAI Profile | Control set designed against RMF core functions (Govern, Map, Measure, Manage). Public alignment attestation. | Aligned |
| SOC 2 (TSC 2017/2022) | Aligned to the Trust Services Criteria. Full internal policy set (10 policies mapped to CC1-CC9) documented and in effect. Type II audit engagement scheduled Q1 2027; Type I attestation issued alongside as part of the same engagement. Not yet a completed certification. Status will update after the CPA firm issues the report. | Aligned (Type II engagement scheduled Q1 2027) |
| ISO/IEC 27001 | Under review as alternative or companion to SOC 2 Type II. Decision on which to pursue triggered by specific buyer requirement. | Deferred |
| GDPR / CCPA | US-based operations. Best-effort compliance for EU and California data subjects. DPA available on written request. Formal DPA-automation and DSAR workflow by Q1 2027. | Aligned |
| HIPAA / PHI | AIMS Charter does not process protected health information. Customers must not upload PHI into the Charter. | Not applicable |
| PCI-DSS | Not applicable directly. Stripe handles all PCI scope on our behalf; we never see or store payment card data. | Not applicable |
Written policies in effect (10, mapped to SOC 2 CC1-CC9): Information Security · Access Control · Change Management · Incident Response · Data Classification & Handling · Vendor / Sub-processor Management · Vulnerability Management · Business Continuity & Disaster Recovery · Acceptable Use · Secure Development Lifecycle. Full policy set available on request under NDA.
Cyber insurance
This page will be updated with policy details (carrier, coverage limits, effective date) once bound. Customers with an active vendor security review can request status by emailing security@highintentdigital.com.
Data Processing Addendum & security questionnaires
DPA. A standard Data Processing Addendum is available on request. It covers our commitments as a data processor under GDPR and CCPA where applicable, the subprocessor list above, security controls, sub-processor engagement, deletion on termination, and international data transfer terms.
Security questionnaires. We answer vendor security questionnaires (SIG Lite, CAIQ, or your team's internal template) as part of procurement. Send yours to security@highintentdigital.com and we typically return a completed response within five business days.
NDA. A mutual NDA can be provided if your team requires one before sharing detailed control evidence.
Frequently asked questions
Where is customer data stored?
Netlify's US infrastructure. See Data handling for details.
Do you have a SOC 2 report?
Not yet. Our internal control set is designed against SOC 2 Trust Services Criteria 2017/2022 (CC1-CC9; see Compliance), and a Type II audit engagement is scheduled for Q1 2027. Once the CPA firm issues the report, it will be available under NDA. In the interim, this page plus a completed vendor questionnaire is what we can offer.
Can I get a Data Processing Addendum (DPA)?
Yes. Email security@highintentdigital.com.
What happens to my data if I cancel?
Cancellation starts a 90-day reactivation window. After that window closes, your account enters our internal deletion queue; a security team member reviews and approves the purge (target: within 5 business days). On approval, all customer account data (profile, users, modules, activity log, AI Risk Snapshot responses) is permanently deleted from primary storage. Backups purge on the next cycle after deletion. See Retention & deletion.
Do you train AI on my data?
No. AIMS Charter does not use customer content to train any model, ours or a subprocessor's. Anthropic (planned Q4 2026 for the Certification Agent feature) has an explicit policy that data submitted via API is not used for training.
Can I self-host or use my own cloud?
Not today. AIMS Charter is a multi-tenant SaaS with logical per-account isolation. If your procurement requires single-tenant or BYO-cloud deployment, contact us and we'll discuss whether an enterprise arrangement is a fit.
How do I report a bug or security issue?
Email security@highintentdigital.com. See Incident response.
Security team
Vendor questionnaires, DPA requests, incident reports, or any other security question.
security@highintentdigital.com