Security and trust

You trust Fix&Affirm with how your company protects Federal Contract Information. Here is, in plain English, where that information lives, who can see it and how we protect it.

Where your data lives

• In the United States, on Google Cloud. The Fix&Affirm app runs on Google Cloud Run in the us-west3 region, in Salt Lake City, Utah.
• Your answers and company details are stored in Google Cloud Firestore, one private workspace per account.
• Your evidence files are kept in a private Google Cloud Storage bucket in the same Salt Lake City region. Public access to the bucket is blocked, and files can only be reached through the app.
• Payments are handled by Stripe. We never see or store your card number.

Who can see it

• Only your signed-in account can read or change your assessment. Our database rules enforce this for every request, and only after you confirm your email address.
• Every file download is checked on our server against your sign-in before the file is sent. There are no public links to your files.
• Fix&Affirm never connects to your computers or network. Nothing is installed, and we never ask for passwords.

Encryption and safeguards

• Every connection to the website and the app is encrypted with HTTPS (TLS).
• Your answers, company details and files are encrypted at rest by Google Cloud.
• Payment and service keys are kept in Google Secret Manager, never in our code.
• Sign-in is with Google, or with an email and password after you confirm your email address. Throwaway email addresses are blocked at sign-up.

What we do not do

• No CUI. Fix&Affirm is built for CMMC Level 1 and Federal Contract Information. It is not a FedRAMP system, so do not enter or upload Controlled Unclassified Information or classified information.
• No AI on your answers. Your results are worked out by fixed rules in our own code. Your answers and files are not sent to any AI model, and we do not use them to train one.
• No selling. We do not sell your information or share it with anyone except the providers that run the service, listed in our privacy policy.

How long we keep it

While your subscription is active, your work stays available all year. When a subscription ends, we keep it for 30 days so you can renew without losing anything, then delete it automatically. Files uploaded without a subscription are deleted 7 days after upload. Deleted files are removed for good, with no hidden recycle bin. You can delete a file at any time, and if you ask us to delete your account we do so within 30 days.

Who we are

FederalShield Cybersecurity LLC is a Utah company based in Salt Lake City. We are a small, independent company, not affiliated with or endorsed by the Department of Defense. You can reach a person at +1 385 379 6200, write to us at 50 W Broadway #300, Salt Lake City, UT 84101, or use the contact form.

Report a security concern

If you think you have found a security problem in the website or the app, please tell us through the contact form or by phone. We will look into it promptly and tell you what we found.