Effective August 2, 2026 · Last updated August 2, 2026
RegulatoryForge (“we,” “us,” “our”) provides CMMC and NIST SP 800-171 compliance document generation and tracking software. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. Questions go to privacy@regulatoryforge.com.
RegulatoryForge is designed to help you describe your security program — not to store the data that program protects. Do not upload Controlled Unclassified Information (CUI), classified information, export-controlled technical data (ITAR/EAR), or personal information about individuals outside your own team. This platform is not assessed or authorized as a CUI enclave and should not be treated as one. If you believe you have uploaded such information, contact security@regulatoryforge.com and we will work with you to remove it.
Information you provide
| Category | Examples |
|---|---|
| Account | Email address and password. Passwords are stored only as a bcrypt hash — we never store your password itself and cannot recover it. |
| Organization | Company name, point of contact, and the names and email addresses of team members you invite. |
| Compliance content | Control implementation statuses, notes, evidence descriptions and links, POA&M entries, SPRS scores, system and network descriptions, vendor and subcontractor records. |
| Support | Messages you send through the contact form or support tickets. |
| Payment | Billing email and subscription plan. |
Information collected automatically
We do not use advertising trackers, and we do not sell personal information.
We do not use your compliance content to train machine learning models, and we do not sell or rent your information to anyone.
We use the following service providers. Each receives only what it needs to perform its function.
| Provider | What it receives | Purpose |
|---|---|---|
| Google Cloud (US) | All application and database data | Hosting, compute, storage, backups |
| Anthropic (US) | The content you submit to an AI-assisted feature, at the time you use it | Generating draft documents and analyses |
| Stripe | Billing email, subscription details, and card data entered directly on Stripe’s page | Payment processing |
| Google Workspace | Recipient address and message content | Transactional email delivery |
| beehiiv | Email address, only if you subscribe | Newsletter delivery |
| Google / Microsoft identity | Email address and basic profile, only if you choose single sign-on | Optional authentication |
About AI processing
Several features generate drafts using Anthropic’s Claude models. When you use one of them, the text you submitted for that request is transmitted to Anthropic for processing and the result is returned to you. Anthropic does not use data submitted through its commercial API to train its models. If you prefer not to have content processed this way, do not use the AI-assisted features — the compliance tracker, SPRS estimator, and document downloads remain available.
Payment card data
We never see or store your full card number, expiration, or CVC. Those are entered directly into Stripe’s hosted checkout and handled under Stripe’s PCI DSS Level 1 certification. We store only a Stripe customer identifier and your subscription status.
We may disclose information if required by law, subpoena, court order, or other valid legal process, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, or to investigate fraud. Where we are legally permitted to do so, we will make reasonable efforts to notify you before disclosing your information in response to a legal request.
No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping your password confidential and for the actions of team members you invite.
Breach notification. If we discover a breach affecting your personal information, we will notify affected users by email without undue delay, and in any case consistent with applicable law.
More detail on our security program is on our Security & Trust page.
Depending on where you live, you may have additional rights — including the right to know what we collect, the right to deletion, the right to correction, and the right not to be discriminated against for exercising them (California residents under the CCPA/CPRA), or rights of access, rectification, erasure, restriction, portability, and objection (residents of the EEA and UK under the GDPR).
We do not sell or share personal information as those terms are defined under the CCPA/CPRA.
To exercise any of these rights, email privacy@regulatoryforge.com. We verify your identity through your registered email address and respond within the timeframe required by applicable law.
RegulatoryForge is hosted in the United States. If you access the service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your country.
RegulatoryForge is a business tool and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact privacy@regulatoryforge.com and we will delete it.
We may update this policy as the product and the law change. When we make a material change, we will update the “Last updated” date above and notify active account holders by email at least 14 days before the change takes effect. Continued use after the effective date constitutes acceptance.
RegulatoryForge
Privacy inquiries: privacy@regulatoryforge.com
Security reports: security@regulatoryforge.com
General: support@regulatoryforge.com
4210 Divided Sky Court