Security Built for Government Contracting (GovCon)
Department of Defense (DoD)-adjacent compliance is different. The data is more sensitive, the regulatory requirements are more specific, and the cost of a breach or finding is measured in contract terminations, not just reputation. ProgramPilot is built with that reality in mind.
Why Department of Defense-Adjacent Security Is Different
Government contractors handle Controlled Unclassified Information (CUI), export-controlled technical data, and financial records subject to Defense Contract Audit Agency (DCAA) oversight. A data breach doesn't just expose customer Personally Identifiable Information (PII), it can trigger Defense Federal Acquisition Regulation Supplement (DFARS) clause violations, contract termination for cause, and debarment proceedings.
Cybersecurity Maturity Model Certification (CMMC) Level 2 assessment requires demonstrating 110 security practices from National Institute of Standards and Technology (NIST) SP 800-171. Many of those practices, access control, audit and accountability, identification and authentication, map directly to platform-level security features, not just policy documents.
DCAA auditors have the authority to disallow costs when adequate internal controls are absent. Adequate internal controls include documented access controls, segregation of duties, and a complete audit trail of every financial decision. ProgramPilot makes these controls automatic.
Unlike commercial Software as a Service (SaaS) environments, GovCon platforms must be able to demonstrate compliance posture at any time, not just when an assessment is scheduled. ProgramPilot's continuous compliance model means your audit trail is always current.
Data Encryption at Rest and In Transit
All data is encrypted at rest using Advanced Encryption Standard (AES)-256. All data in transit is protected by TLS 1.2+. Database credentials, Application Programming Interface (API) keys, and secrets are stored as environment variables, never in source code. File storage uses signed, time-limited URLs scoped to individual tenants.
Dedicated Environment for Every Customer
Every customer runs in its own dedicated environment: its own database, file storage, sign-in user pool, application server, and web application, with security keys generated only for that customer. No other customer's data is stored in, or reachable from, your environment. Inside it, Row Level Security (RLS) is enabled on every database table, the server-side service key is never exposed to the browser, and the application accepts requests only from your own web address.
Authentication: Required Multi-Factor Authentication (Time-based One-Time Password) and Role-Based Access Control
Multi-factor authentication is required for every user in a customer environment: each person sets up an authenticator app at first sign-in, and a session without the second factor is refused. Accounts are created by invitation only. Role-based access control (RBAC) assigns permissions at the contract lead, finance lead, and Program Manager (PM) level.
Tamper-Proof Audit Trail and Compliance Records
The DCAA audit trail is tamper-proof. Every invoice, approval decision, document event, and system action is recorded with the user who took it. The database refuses every edit and deletion, sets each entry's time itself, and seals every entry to the one before it with a SHA-256 hash, so any change, even by someone with database access, is detectable. You can verify the chain and export it, with every hash, at any time. Billing-outside-Period of Performance (PoP) flags, invoice sequencing gap detection, and DCAA readiness baseline scoring are computed continuously against this log.
Controlled Unclassified Information Data Handling and Defense Federal Acquisition Regulation Supplement Compliance Documentation
You decide whether Controlled Unclassified Information (CUI) ever reaches ProgramPilot. Document-Free Mode hides every file upload for your organization, and CMMC Boundary Mode turns off every AI feature so nothing is sent to an external AI service. Data residency is United States (Ohio).
Cybersecurity Maturity Model Certification Alignment (Level 2)
ProgramPilot's controls map to CMMC Level 2 practice areas including access control (AC), audit and accountability (AU), identification and authentication (IA), and system and communications protection (SC). ProgramPilot runs on commercial cloud infrastructure and is not itself CMMC certified. Enterprise plans include CMMC readiness consulting support.
Upload Type Validation
Uploaded documents are checked against their declared file type by inspecting the file's contents, and files that do not match are rejected before storage. Uploads are limited to approved document types and sizes, stored with no public access, and downloaded only through signed, expiring links.
Rate Limiting and Brute Force Protection
Sign-in attempts are rate limited, and repeated failed sign-ins lock the account temporarily. Session refresh has its own stricter limit, and every API endpoint carries a server-side rate limit. All limits are enforced on the server and cannot be bypassed by client behavior.
Secure File Storage
Files are stored in private, access-controlled object storage inside your dedicated environment. No file is publicly accessible: every download link is a signed URL with a short expiration window.
Open Worldwide Application Security Project (OWASP) Top 10 Mapped Controls
Injection (A03): parameterized queries throughout. Broken Access Control (A01): a dedicated environment per customer, role-based permission checks, and server-side ownership checks on program data. Cryptographic Failures (A02): TLS 1.2+ in transit, AES-256 at rest. Security Misconfiguration (A05): security headers, a single allowed web origin per customer environment, no default credentials. Identification and Authentication Failures (A07): required MFA, invitation-only accounts, rate limiting.
Data Residency
All ProgramPilot data is stored in the US East (Ohio) region. Data does not leave the continental United States. This residency posture supports DFARS 252.204-7012 requirements and is consistent with CUI handling obligations for DoD contractors.
Responsible Disclosure
If you discover a security vulnerability in ProgramPilot, please report it responsibly. Send a detailed description to security@programpilothq.com. We commit to acknowledging your report within 48 hours and providing a resolution timeline within 5 business days. We do not take legal action against good-faith security researchers.
Security questions before you start?
Contact our team and we'll walk you through our security posture in detail.
Get Started →