01 — SECURITY

What we do, and what we do not claim.

We score other companies' compliance posture, so ours had better be legible. Every control below carries its real state. Where something is not built yet, it says planned — because a security page that reads like a brochure is worth nothing to the person reading it.

Last updated 2026-09-20

02 — DATA CLASSIFICATION

GovExpress runs on public federal data. The most sensitive thing we hold is a company describing itself.

What we hold

Public federal records — SAM.gov registrations, USASpending and FPDS obligations, the FedRAMP Marketplace, GSA CALC+, SBIR.gov — plus the business information you submit in a report intake, your account email, and billing records held by our payment processor.

What we will not hold

No controlled unclassified information. No classified information. No export-controlled technical data. No consumer personal information, no health information, and no payment card numbers. Our terms prohibit submitting any of it, and the service is not built to receive it.

Why the ceiling is low on purpose

Classified awards are exempt from public reporting under FAR 4.606(c) and the government's supplier risk system is government-only. We have no route to either, so there is nothing of that sensitivity in the product to lose.

If you send us something you should not

Tell us at security@govexpress.ai and we will delete it and confirm the deletion. Do not send a second copy to prove the first one existed.

03 — ENCRYPTION IN TRANSIT

HTTPS on govexpress.ai
In place
Served over TLS through Amazon CloudFront. Plain HTTP returns a 301 to the HTTPS origin.
HTTP Strict Transport Security
In place
Sent on every response with a one-year max-age. It does not yet carry includeSubDomains or preload; both are queued, because preload in particular is hard to reverse and wants every subdomain ready first.
Hardening headers
In place
X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and X-Frame-Options: SAMEORIGIN are sent on every response.
Content Security Policy
Planned
No CSP or Permissions-Policy header is sent today. Both are queued; a CSP has to name each inline script this site relies on before it can be turned on without breaking the page.
TLS on app.govexpress.ai
In place
TLS 1.2 minimum everywhere. CloudFront serves govexpress.ai, www.govexpress.ai, govexpressai.com and app.govexpress.ai on the TLSv1.2_2021 policy with ACM certificates, and redirects HTTP to HTTPS. The load balancer in front of the application uses ELBSecurityPolicy-TLS13-1-2-2021-06 — TLS 1.3 available, TLS 1.2 floor — and answers plain HTTP with a 301 to HTTPS.

ENCRYPTION AT REST

Marketing site storage
In place
This site is static files in Amazon S3 with no database and no customer data of any kind. Encryption at rest is provided by S3.
Customer data at rest
In place
The RDS PostgreSQL database and the ElastiCache Redis cache are encrypted at rest with AWS KMS, using AWS-managed keys. Amazon S3 buckets are encrypted with SSE-S3 (AES-256). All public endpoints require TLS 1.2 or higher. Traffic between our own services and the cache travels over a private network and is not itself encrypted.

04 — HOSTING AND REGION

govexpress.ai — this marketing site — is a static build with no server-side code and no database. It is stored in Amazon S3 and served through Amazon CloudFront, in AWS region us-east-1. CloudFront is a global network, so the page you are reading may have been served from an edge location near you; the origin and every stored byte stay in the United States. No customer data touches this site.

app.govexpress.ai — the signed-in application, where intake and reports live — is a separate deployment. Provider: Amazon Web Services. The application runs on ECS Fargate — an API service, a worker service and a vector-store service — with Amazon RDS for PostgreSQL 15, Amazon ElastiCache for Redis, Amazon S3 for object storage, an Application Load Balancer, and Amazon CloudFront in front of both this site and the application.. Region: US East (N. Virginia), us-east-1, for all compute, database, cache and storage. CloudFront also serves from edge locations outside the United States: this site and govexpressai.com use the all-locations price class, and app.govexpress.ai uses the North America and Europe price class.. We publish these rather than saying "the cloud", because a buyer assessing us needs to know where their data sits.

05 — AUTHENTICATION AND ACCESS CONTROL

Sign-in
In place
You sign in with a one-time link sent to a verified email address. There is no password to steal, reuse, or phish for. The API accepts a signed RS256 token, verifies it against the issuer’s published keys, and checks the issuer and the client ID on every request.
Least privilege
Planned
Access to customer data limited to the people who need it to deliver a report, reviewed on a stated cadence and revoked on departure.
Deploy path
Planned
This site deploys through GitHub Actions — on a push to the main branch, and on a manual dispatch that can build any branch. Restricting manual dispatch, and replacing the long-lived access key with a short-lived scoped role, are both planned.
Build gates
In place
Every deploy runs a containment check that fails the build if internal scoring identifiers reach public output, plus a build-output verification step.
Audit logging
Planned
Recorded, reviewable logs of administrative access to customer data.

GovExpress is a small team, which cuts both ways: the number of people who could touch customer data is very small, and we do not have a security department. We would rather tell you that than imply a staffed function that does not exist.

06 — YOUR DATA IS NOT TRAINING DATA

GovExpress does not use Customer Data to train, fine-tune, evaluate, or benchmark any machine-learning model, its own or a third party's. This applies in aggregate and in de-identified form. GovExpress does not sell Customer Data and does not share it for cross-context behavioral advertising. There is no opt-out to configure and no plan tier under which this changes.

This is restated here because it is a security property, not only a privacy one: it bounds where your data can travel. The same paragraph is a binding term of the privacy policy and of the terms of service. It binds GovExpress. It is not a claim about what our service providers have signed — we have not executed a data processing agreement with any of them, and the service provider page says so and sets out the standard such an agreement will have to meet.

07 — HOW THE SCORE IS CONTAINED

Scoring runs server-side. Clients receive final scores, bands, and narratives only — never indicator IDs, weights, thresholds, or evaluation logic. That is an architectural commitment, not a configuration setting, and a build gate fails the release if any of it reaches a public page.

The reason it is worth saying out loud is that the alternative is the industry norm. A score computed in the browser, or delivered with its component parts attached, is a score anyone can take apart and rebuild — and the companies being scored are the ones with the strongest reason to try. Keeping the evaluation server-side is what makes a published methodology safe to publish: you can read what the model looks at and why, without being handed the means to game it.

Attempting to reconstruct the methodology — by inspection, by systematic querying, or by training a model on our outputs — is a breach of the acceptable use policy.

08 — SERVICE PROVIDERS

These service providers process data on our behalf. The service provider page carries the full table, what each one receives, and the date it was last reviewed; the privacy policy carries it too, along with the third parties this marketing site talks to. No data processing agreement has been executed with any of them yet, and that page says so.

Amazon Web Services
United States (us-east-1); CloudFront edge locations worldwide
Hosting, storage, database, cache and CDN for this site and the signed-in application, and the identity provider behind sign-in.
Stripe
United States
Payment processing, subscription billing and the customer billing portal.
Resend
United States
Transactional email — sign-in links, email-address confirmations, report delivery and account notices.
Anthropic
United States
Generates the written sections of a readiness report.
PostHog
United States
Product analytics inside the signed-in application. No analytics tag loads on this marketing site — a build gate enforces that.
Cloudflare
Global edge network
Turnstile bot protection on the intake form.
Brave Software
United States
Web search used to enrich a company profile during report generation.
Google
Global edge network
Google Fonts serves two typefaces used across this marketing site. We run no Google Analytics.

We give notice before adding a service provider that will handle customer data, so you can object before it starts.

09 — INCIDENT RESPONSE

If we confirm a security incident affecting customer data, we notify affected customers by email within 72 hours of confirming it, and we notify regulators where the law requires it. The notice states what happened, what data was involved, what we have done, and what you should do. We send it even when the answer to the last question is "nothing".

We do not wait for a complete investigation to tell you an incident happened. A first notice inside the window with partial facts, followed by updates, beats a polished one that arrives late.

A formal, tested incident response runbook is planned, not written. Today the process is the commitment above and a very short chain of command.

10 — WHAT WE DO NOT CLAIM

Most security pages are a list of logos. This is the list of logos we do not have. Every line below is a claim we are not making.

We are not FedRAMP Certified

GovExpress holds no FedRAMP certification at any class or impact level, holds no legacy authorization either, and is not listed in the FedRAMP Marketplace. We report other companies’ FedRAMP status from that Marketplace; we have none of our own to report. (The 2026 Consolidated Rules retired “Authorized” as the status term in favour of “Certified” — the change in wording does not change what we hold, which is nothing.)

We are not a C3PAO or a 3PAO

We are not a Certified Third-Party Assessment Organization, not a FedRAMP Third Party Assessment Organization, and not accredited by the Cyber AB or any other body. We cannot assess you, and an assessor cannot use our output as evidence.

We are not a certification body

A Federal Readiness Score certifies nothing. It is a diagnostic computed from public data, and presenting it as a certification or a government endorsement is a breach of our terms.

We hold no SOC 2, ISO 27001, or CMMC certification

No audit has been performed and no report exists. If that changes we will name the auditor, the report type, and the period, and you will be able to ask for the report itself.

We are not authorized for CUI or classified information

The service has no authorization to receive, store, or process controlled unclassified information or classified information, and no environment built for it.

11 — FOUND A VULNERABILITY?

Report it to security@govexpress.ai. We work to a 90-day coordinated disclosure window and we will not pursue you for good-faith research. The scope, the rules, the safe harbour, and the honest note that there is no bug bounty are all on the vulnerability disclosure page.

The machine-readable version is at /.well-known/security.txt.

Found a hole in this page? Tell us.

Email security@govexpress.ai