Security & data handling

WorkuGRC drafts readiness documents for defense subcontractors, so we expect you, or your IT consultant, to ask hard questions before entering anything. Here are the answers in plain English.

1. We never hold CUI

The most important design decision: the product never asks for Controlled Unclassified Information. We collect information about your environment, never what is in it.

No file uploads. The one exception is an optional company logo for your document cover page (PNG or JPEG only, checked by file content, capped at 300 KB, with metadata stripped).
No free-text answers. The questionnaire is multiple-choice. The few short text fields (company name, industry, a one-sentence description, and a responsible party for each POA&M item) are for profile details only. Never enter contract data, drawings, or technical data in them.
Because we hold no CUI, the safety of your CUI does not depend on our systems.

2. What we store

Your account email and sign-in credentials (passwords are hashed by our auth provider).
Company profile: name, size band, industry, a one-sentence description, optional CAGE code.
Your multiple-choice questionnaire answers.
The draft SSP and POA&M generated from those answers, with the responsible party and milestone date you set on each POA&M item.
Your cover logo, if you add one.

The full list, including the service providers that process data for us, is in the Privacy Policy.

3. How your data is protected

Isolation is enforced in the database. Every customer table has row-level security scoped to your organization. Automated tests run against the database to confirm one company cannot read or change another company's data.
Encryption in transit (TLS) and at rest (our managed database provider's default).
Sign-in: passwords of 10 or more characters or emailed sign-in links, with two-factor authentication available to every account and required for administrators. Sign-up and reset screens do not reveal whether an email is registered.
Rate limits on sign-in, public tools, exports, and document generation.
Browser protections on every page: Content-Security-Policy, HTTPS-only (HSTS), no embedding in other sites, no content-type sniffing.
Secrets stay in server configuration. They are never in the code or sent to your browser.

4. How AI is used, and what it sees

Document drafting uses Anthropic's Claude API, called from our servers only.
It receives your company profile and the questionnaire answers needed for the section being drafted. Nothing else.
Under Anthropic's commercial API terms, this data is not used to train their models.
Your implementation status for each requirement is taken from your answers, not from the AI. The AI writes the narrative text.
Answer content never appears in our application logs or analytics. Analytics is off until you accept it, and carries counts and ids only.

5. Your score and documents

Your SPRS score is calculated by a tested engine that follows the published DoD Assessment Methodology, with conservative defaults: an unanswered item counts against you, and there is no partial credit beyond the two exceptions the methodology allows.

The score is a self-assessment result based on your answers. We do not verify it, and it is not an official DoD score. Every generated document is marked as a draft on its cover and on every page. WorkuGRC is a drafting tool, not an auditor, a C3PAO, or a source of legal advice.

6. Deleting your data

An organization owner can schedule deletion from Settings. After a 30-day grace period (so an accidental deletion can be undone), we permanently remove the organization, its assessments, answers, and documents, and the accounts that belong only to it. Free-tool results emails are deleted on request.

7. Where it runs, and what we have not done

The application is hosted on Vercel and the database on Supabase. Both providers publish SOC 2 Type II reports for their own infrastructure.

To be clear about the limits: WorkuGRC itself has not had an independent security audit or penetration test, and holds no certification of its own. Our code is reviewed internally, dependencies are checked for known vulnerabilities on every change, and findings are tracked to closure.

8. Reporting a security issue

Email support@workugrc.com with "Security" in the subject. We aim to acknowledge within 2 business days. Please do not test against other customers' data.