Privacy Policy
Effective November 8, 2026
This policy explains how CloudOneSoftware LLC ("we", "us") handles information through AssuranceGraph: the website at assurancegraph.ai and the app at app.assurancegraph.ai (together, "the Service"). AssuranceGraph is business software, sold to organizations preparing for CMMC assessments.
Information we collect
- Account information: your name, work email address and the user identifier your sign-in provider gives us, plus the workspaces you belong to and your role in each.
- Workspace content: what your organization enters, such as requirement status, evidence descriptions and file hashes, policies, the System Security Plan, POA&M items, release scan results and the audit log of changes. Your organization controls this content; we process it on its behalf.
- Billing information: your plan, subscription status and the Stripe customer and subscription identifiers. Card numbers and bank details go to Stripe directly; we never see or store them.
- Technical information: IP address, browser type, request times and request identifiers, used to secure the Service, limit abuse and fix problems. Our logs record that a request happened; they do not record what you typed or uploaded.
- Email you send us, for example to join the pilot or ask for support.
The website at assurancegraph.ai sets no cookies and runs no analytics or advertising trackers. The app uses the cookies or browser storage needed to keep you signed in.
Controlled Unclassified Information
The hosted Service is designed for compliance records, not for CUI itself, and our Terms of Service ask you not to upload CUI to it. In Sovereign Mode (Enclave plan), AI requests that involve CUI are handled by a model running on your own hardware and are not sent to us.
How we use information
- to provide the Service, including signing you in, enforcing workspace roles and producing the scores and documents you ask for;
- to process subscriptions and send service messages, such as billing notices and security alerts;
- to secure the Service, prevent misuse and keep an audit trail;
- to answer your questions and improve the Service.
We do not sell personal information, share it for cross-context behavioral advertising, or use workspace content to train AI models.
Who helps us run the Service
We use these service providers, each bound to protect the information and use it only to provide its service to us:
| Provider | What they do | Information involved |
|---|---|---|
| Google Cloud | Hosts the app and its database in the United States; provides sign-in | Account information, workspace content, technical information |
| Cloudflare | Hosts the website, and protects and delivers traffic to the app | Technical information |
| Stripe (including Link) | Merchant of record, through its Link service: takes payments, calculates and collects tax, issues invoices, runs the billing portal | Billing information, name, email address, billing address |
| Google Fonts | Serves the typeface on assurancegraph.ai | Your IP address and browser details, sent by your browser when the page loads |
Stripe, through its Link service, acts as merchant of record for your purchase, so it handles payment information under Link's privacy policy as well as ours. We will update this list before we add a provider that receives workspace content, including any AI model provider used for features outside Sovereign Mode.
We may also disclose information when the law requires it, to protect the rights and safety of our customers or the Service, or as part of a merger or sale of our business, in which case this policy continues to apply.
How long we keep it
- Workspace content: while the subscription is active, then deleted within 90 days of its end unless your organization asks us to export or delete it sooner.
- Audit log entries: kept with the workspace, because they are your evidence trail.
- Billing records: as long as tax and accounting laws require.
- Technical logs: up to 30 days, longer only when needed to investigate a security incident.
Security
Traffic is encrypted in transit, the database keeps each organization's data separate with row-level security, every change is recorded in a tamper-evident audit log, and access is limited by workspace role. No system is perfectly secure; we will tell affected customers without undue delay if we confirm an incident that affects their information.
Your choices and rights
You can see and update your account information in the app. Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, or to object to certain uses. Email contact@cloudonesoftware.com and we will respond within 30 days. If your information is part of an organization's workspace, we may refer your request to that organization, which controls the workspace.
Children
The Service is for businesses and is not directed to children under 16. We do not knowingly collect their information.
Changes
We will post any update here with a new effective date. For material changes, we will also tell customers by email or in the app before they take effect.
Contact
CloudOneSoftware LLC, 62 Danforth Ave, Jersey City, NJ 07305
contact@cloudonesoftware.com