Faithful Oversight, LLC
How we protect your data
How client information is handled, described plainly and without overclaiming.
Clients trust Faithful Oversight with access to sensitive systems and information, so how that information is handled matters. This page describes the practices in place today. It is not a certification or an audit report, and we have tried not to say more than is true.
The business portal
- Engagement records live in a private business portal. It sits behind Cloudflare Access, and the owner signs in with an emailed second factor.
- Links sent to clients are single-purpose, unguessable, and expiring. Each link opens one thing, such as one questionnaire or one agreement, and stops working after it expires.
- Signing an agreement can require an emailed one-time code. This is on by default when the work involves CUI, FCI, PHI, banking, or payment-card data.
Backups
Portal data is backed up nightly. Backups are encrypted with age, an open-source encryption tool. The private key is held offline by the owner and rotated yearly.
Records retention
A written retention schedule governs client records:
| Record | Kept |
|---|---|
| Raw technical evidence | Deleted 90 days after report delivery, or 30 days after the agreement ends, whichever comes first |
| Detailed assessment records | Reduced to a sanitized summary with identifying technical details removed |
| Full reports | Kept encrypted for 3 years |
| Executed agreements | 10 years after the relationship closes |
| Financial records | 7 years |
A per-client legal hold can pause deletion when a matter requires it, and a destruction record is kept when data is deleted. Individual agreements may set different terms in writing, and those terms govern that client's records.
Sensitive and controlled information
Controlled Unclassified Information (CUI) is handled only inside systems the client furnishes, unless a signed Work Order says otherwise. It is not copied into our own systems by default.
Assessment tooling
Assessment tooling is read-only. It consists of transparent scripts that the client can review before running them, so you know what will be collected from your environment.
What this is not
Faithful Oversight is not a C3PAO or PCI QSA. Readiness work does not result in certification.
What not to send us
Please never send passwords, keys, or sensitive system details through the website contact form or by regular email. We will arrange a suitable channel once an engagement is agreed.
Security questions or concerns
For security questions, or to report a vulnerability on this website, email filip@faithfuloversight.com. Our security.txt has the same contact details. The Privacy Policy explains how we handle information you send through this site.