Security built for the people accountable for delivery

SightLinePM operates a written information security program modeled on the NIST Cybersecurity Framework (CSF 2.0) and the AICPA SOC 2 Trust Services Criteria (Security, Availability, Confidentiality). The program is owned by the Head of Security, reviewed quarterly by leadership, and updated at least annually or after any material change to the product, infrastructure, or threat landscape.

Every employee and long-term contractor completes security and privacy training at hire and annually thereafter, including phishing simulations, secure-coding refreshers, and data handling. Background checks are performed on all personnel with production access, where permitted by law.

SightLinePM is hosted on Supabase running on Amazon Web Services (AWS) inus-east-1by default, with EU residency (eu-central-1) available on Enterprise. Edge traffic is fronted by Cloudflare, which terminates TLS, absorbs L3/L4 and L7 DDoS attacks, and applies a managed Web Application Firewall (WAF) ruleset tuned for the OWASP Top 10.

We operate no physical data centers. Physical security, environmental controls, hypervisor isolation, and hardware lifecycle are inherited from AWS's SOC 2 Type II, ISO 27001, and ISO 27017/27018 programs. Production networks are private by default; no database or internal service is exposed to the public internet.

Customer data is logically isolated by tenant. Every row in the multi-tenant Postgres database carries a workspace_idand is protected by Row Level Security (RLS) policies enforced by the database itself — defense that holds even if an application-layer bug tries to query across tenants.

All code changes flow through pull requests with mandatory peer review, automated unit and integration tests, dependency vulnerability scanning (SCA), static analysis (SAST), and secret scanning before merge. Production deploys are automated, signed, and traceable to a specific commit and reviewer.

We run third-party penetration tests at least annually and after any material architectural change; a summary letter is available under NDA. We operate a continuous bug bounty channel via security@sightlinepm.com and triage all reports against CVSS v3.1.

Application, authentication, and infrastructure events are centralized in a tamper-evident logging pipeline with a minimum 365-day retention. Anomalous authentication patterns, privilege escalations, mass exports, and integration token misuse generate real-time alerts to the on-call security engineer.

Edge and WAF logs feed automated rate-limiting and bot mitigation. Production systems are monitored 24/7 for availability and security events via paging rotations with documented response SLOs.

SightLinePM uses large language models to draft briefings, summarize status notes, and surface risks. Customer data sent to LLM providers is transmitted under zero-retention API agreements: prompts and completions are not used to train provider models and are not retained beyond the time required to return a response.

You can disable AI features per-workspace. Enterprise customers can pin inference to a specific model and region, or bring their own LLM credentials.

SightLinePM targets 99.9% monthly uptime for the production application (99.95% on Enterprise SLAs). Infrastructure runs multi-AZ with automated failover for the database tier. We publish real-time status, incident timelines, and post-mortems at status.sightlinepm.com.

Every subprocessor is reviewed before onboarding against security posture, certifications, data residency, and contractual safeguards (DPAs, SCCs). Reviews are repeated annually. The current list below is authoritative and updated whenever a subprocessor is added or removed; material changes are announced with at least 30 days' notice via email to workspace administrators.

Need our SOC 2 / ISO inheritance letter, DPA, SCCs, pen-test summary, security questionnaire, or insurance certificates? Email security@sightlinepm.com and we'll turn them around within two business days.

We operate a documented incident response plan aligned to NIST SP 800-61 with defined severities, on-call rotations, and tabletop exercises at least twice a year. In a confirmed security incident affecting customer data, we will notify affected workspace administrators without undue delay and in any case within 72 hours of confirmed discovery — consistent with GDPR Article 33 — including the nature of the incident, data categories involved, our current containment status, and recommended actions.

Every Sev-1 and Sev-2 incident receives a written post-mortem with root cause analysis and corrective actions. Enterprise customers receive tailored notifications via their named contacts and contractual channels.

We welcome reports from security researchers and treat coordinated disclosure as a partnership. Please email security@sightlinepm.com (PGP key available on request). We commit to:

• Acknowledge your report within 2 business days.
• Provide a triage decision and CVSS scoring within 5 business days.
• Share a remediation timeline within 10 business days.
• Credit you publicly (with your permission) once a fix is shipped.
• Refrain from any legal action against researchers acting in good faith, within the bounds of our safe-harbor policy: no privacy violations, no data destruction, no service degradation, no social engineering of staff.

This list is authoritative. Workspace administrators can subscribe to subprocessor change notifications at security@sightlinepm.com.

Security is a shared model. SightLinePM is responsible for the security of the platform: infrastructure, application code, encryption, monitoring, and the controls described on this page. You are responsible for security in your workspace: provisioning the right people with the right roles, enforcing SSO/MFA, reviewing integration scopes, classifying what you upload, and offboarding users promptly. We give you the controls; you make the policy decisions that fit your organization.

For security reviews, vendor assessments, DPAs/SCCs, questionnaires, certificates of insurance, or vulnerability reports, contact our security team directly:

• General security inquiries: security@sightlinepm.com
• Vulnerability disclosure: security@sightlinepm.com (PGP available)
• Privacy / data subject requests: privacy@sightlinepm.com
• Trust center & documents: trust@sightlinepm.com

We respond to all security inquiries within two business days, Monday–Friday.