Continuity Intelligence

    Trust Center

    Start your security review

    Request our policies, control matrix, and SOC 2 readiness package under NDA.

    Request access

    Last updated: October 8, 2026

    Overview

    Continuity Intelligence keeps training and help content accurate. Our platform scans your content for drift, verifies every claim against the source of truth, and helps your team fix what changed.

    This Trust Center shows how we protect your content, your credentials, and our platform. Every control listed here is part of our SOC 2 program, with an owner, a schedule, and dated evidence.

    Questions? Email security@continuityintelligence.com

    Compliance

    SOC 2
    Type 2
    In progress

    An independent CPA firm is examining our controls against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality.

    Observation period:
    September 1 to November 30, 2026
    Report expected:
    by January 2027
    43 controls in operation 16 security policies MFA enforced TLS 1.2+ with HSTS

    Documents

    • SOC 2 Type 2 report

      COMPLIANCE · Private

      Expected by January 2027

    • SOC 2 readiness package

      COMPLIANCE · Private

      Request access

    • Information security policy set (16 policies)

      POLICIES · Private

      Request access

    • Control matrix (43 controls)

      COMPLIANCE · Private

      Request access

    • System description and data flow diagram

      REPORTS · Private

      Request access

    • AI and Data Usage Policy

      POLICIES · Private

      Request access

    • Data Processing Addendum (DPA)

      LEGAL · Private

      Request access

    • Privacy Policy

      LEGAL · Public

      View

    • Terms of Service

      LEGAL · Public

      View

    Subprocessors

    CompanyPurpose
    CloudflareHosting, edge network, and dashboard storage
    GitHubScan data and source code storage
    Google WorkspaceEmail, documents, and business records
    AnthropicAI analysis, under a signed Data Processing Addendum

    We review each provider's independent security audit report every year.

    Trust Center Updates

    1. October 2026Product security

      Claude connector launches with OAuth 2.1

      Connecting Continuity Intelligence to Claude uses OAuth 2.1 with PKCE, one-hour access tokens, rotating refresh tokens, and rate-limited sign-in.

    2. September 2026Audit

      First quarterly security review held

      Our founders ran the quarterly access review, laptop security attestations, a workspace isolation test, and a backup restore test.

    3. September 1, 2026Audit

      SOC 2 Type 2 observation period begins

      Our examination with an independent CPA firm covers Security, Availability, and Confidentiality from September 1 to November 30, 2026.

    4. August 2026Compliance

      Annual security program review completed

      All 16 security policies were re-approved by our CEO, every founder completed security awareness training and signed our Code of Conduct, and we ran an incident response tabletop exercise, a risk review, and a review of every subprocessor's security audit report.

    5. August 2026Infrastructure

      Access and encryption hardening

      MFA is now enforced organization-wide on GitHub, account-wide on Cloudflare, and across Google Workspace. Cloudflare now validates certificates end to end (Full strict), with TLS 1.2 minimum and HSTS. Our AI provider relationship runs under a signed Data Processing Addendum.

    6. July 2026Application security

      Secret scanning and protected releases

      Every commit is now scanned for leaked secrets, dashboard passwords are stored only as one-way hashes, production releases require a pull request on a protected branch, automated dependency security updates are on, and synthetic uptime monitoring runs around the clock.

    Controls

    Controls currently in operation at Continuity Intelligence.

    Infrastructure

    • Serverless platform

      Runs on Cloudflare's global network, with no servers of our own to patch or expose.

    • DDoS protection

      Cloudflare's DDoS protection sits in front of every request.

    • Managed certificates

      TLS certificates and private keys are managed by Cloudflare; we never handle them.

    Data Security

    • Encryption in transit

      TLS 1.2 minimum and TLS 1.3 preferred on every hostname; older protocols are refused.

    • End-to-end certificate validation

      Cloudflare Full (strict) mode, with HTTPS enforced everywhere.

    • HSTS

      Browsers are told to use HTTPS only, on every hostname.

    Access Control

    • MFA on every internal system

      Enforced organization-wide on GitHub, account-wide on Cloudflare, and across Google Workspace, plus every other tool that supports it.

    • Least privilege

      Only the people who need customer data can reach it.

    • Quarterly access reviews

      Access is checked every quarter against a written access matrix.

    Product Security

    • Hashed credentials

      Dashboard passwords are unique to each customer and stored only as one-way hashes, never in plaintext.

    • Constant-time checks

      Credential checks run in constant time.

    • Access logging

      Failed sign-ins are logged with time, IP address, and path, along with page views and report downloads.

    AI

    • No training on your data

      Your content is never used to train AI models, by our AI provider or by us.

    • Single disclosed AI subprocessor

      Anthropic, under commercial terms and a signed Data Processing Addendum.

    • Purpose limitation

      Content goes to the AI service only to produce the analysis you engaged us for. No advertising, profiling, or resale.

    Secure Development

    • Protected releases

      Every production release goes through a pull request on a protected branch; direct pushes and force pushes are blocked for everyone, admins included.

    • Second-person review

      A second founder reviews every production change.

    • Secret scanning

      Every commit is scanned for leaked secrets before it is made and again when it reaches our code host.

    Monitoring and Incident Response

    • Around-the-clock uptime checks

      Automated probes of the customer dashboard open an incident ticket and alert the team on any failure.

    • Monthly log review

      Provider audit logs and error logs are reviewed every month.

    • Incident response plan

      A written plan with severity levels, named roles, and ready-to-send customer notices.

    Data Privacy and Retention

    • You own your data

      Your content and data remain yours, and every scan produces an exportable PDF report.

    • Clear retention

      Scan data is kept for the life of your engagement plus 90 days.

    • Automatic log expiry

      Dashboard activity logs expire after 90 days.

    Credentials and Integrations

    • Read-only by default

      Scans work from the outside in, on the content you point us to. Nothing is installed in your environment.

    • Approved channels only

      Login credentials for gated content are accepted only through your own secret manager or an expiring encrypted share link, never by email, Slack, text, or phone.

    • Session-only handling

      Credentials stay on an encrypted company machine for the scan session only, are never stored in code or sent to AI, and are destroyed afterward.

    Corporate and Endpoint Security

    • Full-disk encryption

      Every company laptop is encrypted.

    • Screen lock and firewall

      Automatic screen lock and a host firewall on every laptop.

    • OS updates

      Laptops stay on current operating system and security updates.

    Policies

    Available on request under NDA.

    • Information Security

    • Acceptable Use

    • Access Control

    Need help with a security review?

    Contact security

    Think you have found a vulnerability?

    Report an issue