Trust & security at Standpoint
We build a tool that helps teams get secure and audit-ready, so it's only fair that we're transparent about how we handle your data and where we are on our own security journey. Here's the honest picture — no inflated badges.
How your data is handled
Your assessment stays in your browser
Today the app runs entirely client-side. Your answers, evidence notes, status and score are saved locally in your own browser and stay on your device between sessions — they are never sent to or stored on our servers. The app keeps the record of your evidence (your notes, links and status for each control); your source documents stay with you.
No selling your data
We don't sell or rent personal data, and we don't run third-party advertising trackers on the app. If you opt in to our newsletter, you can unsubscribe anytime.
You stay in control
Because your data lives in your browser, it's tied to that browser on that device: it survives restarts, but it won't follow you to a different browser or computer, and clearing your browsing data removes it. Use Export JSON anytime to back up your assessment or carry it between browsers — and when we add optional accounts, cloud sync will be your choice, not a requirement.
Upload evidence, not sensitive data
When optional cloud accounts arrive, the evidence vault is for evidence of your controls — policies, procedures, configuration screenshots, audit logs. Please do not upload Protected Health Information (PHI), live production data, or secrets; redact anything sensitive first. Uploads are kept private, encrypted, and scanned for malware. Storing regulated health data under a Business Associate Agreement (BAA) is a separate, future option — contact us if you need it.
Where your data lives: free is local, paid adds the cloud
Anyone can create an account, but a free account is browser-only — your data stays on your device. The cloud (cross-device sync and the evidence-document vault) is part of a paid plan. Signing in never uploads anything by itself.
Free — browser-based
Run the full self-assessment, scoring and gap analysis entirely in your browser — with or without a free account. Record evidence notes and links for each control. Nothing is uploaded; it’s private and works offline. Trade-offs: it’s tied to one browser/device, with no team sharing and no document vault.
Paid — cloud + evidence vault
On a paid plan, your assessments are saved to your private account by default (with a per-audit option to keep one local): synced across your devices, shareable with your team, and with the evidence vault for uploading documents. Cloud data is encrypted, isolated to your organization, and every file is malware-scanned before storage.
Uploading evidence files is a paid, cloud feature (so they can be scanned and stored securely); evidence notes and links are free in the browser. Either way you stay in control — use Export JSON to back up or move your data anytime.
Our own security posture — stated honestly
We're an early-stage company and we believe in saying exactly where we are rather than implying certifications we don't hold. Here's the current state:
| Status | Item |
|---|---|
| In place | Client-side architecture — assessment data does not leave your browser in the current product. |
| In place | HTTPS everywhere; least-privilege access to our own systems. |
| In progress | Formalizing our internal policies and evidence using Standpoint itself (we run our own assessment). |
| Planned | When we add optional accounts, our backend will run on SOC 2 / ISO 27001-certified infrastructure providers, with tenant isolation and encryption at rest. |
| Planned | A formal third-party assessment once we store customer data at scale. |
We'd rather under-claim and over-deliver. We will update this page as our posture matures, and we won't display a certification badge unless we actually hold it.
Responsible disclosure
If you believe you've found a security issue in our website or app, we want to hear from you. Please email info@aiservicepro.net with the details and steps to reproduce. We'll acknowledge your report, work with you on a fix, and credit you if you'd like. Please give us a reasonable chance to remediate before any public disclosure.
Sub-processors & infrastructure
The marketing site and app are served as static files from our hosting provider. We use a privacy-respecting email service for newsletter opt-ins. As we add backend features, we'll list the sub-processors we rely on here so you always know who touches your data.
We use Standpoint to track our own readiness. Run the same free check on your team and see where you stand.
Standpoint is a self-assessment aid — not a certification, attestation, or legal advice.