Trust / A clear statement of status
Controls you can inspect. Claims you can check.
Security and accessibility start with the workflow and its risks. This page distinguishes offered approaches, planned assurance work, and documents to discuss before contracting.
A control model for each program.
- Define SAML/OIDC identity and role- or record-scoped permissions.
- Plan append-only audit events, retention, and export requirements.
- Select U.S.-only data residency where it is an engagement requirement.
- Define encryption, secrets management, vulnerability handling, and deployment controls.
- Agree recovery time and recovery point objectives; test the recovery and export path.
These are offered design approaches. The contract and architecture review establish which controls apply.
Assurance status, stated plainly.
No SOC 2 certification, FedRAMP authorization, or published VPAT is represented on this website. Readiness, alignment, and delivery plans do not establish certification.
| Area | Approach / document | Status |
|---|---|---|
| Identity & access design | Offered for scoped engagements: SAML/OIDC integration, a role matrix, record scoping, and agency or site partition tests. These are design proposals, not an attestation. | On request |
| Audit & retention design | Offered for scoped engagements: append-only event design, retention rules, authorized history access, and export verification. | On request |
| Residency & hosting review | An agreed U.S.-only residency design can cover storage, processing, logs, and backups. Confirm the complete service boundary during discovery. | On request |
| Recovery & incident planning | Define responsibility, incident intake, recovery objectives, backup restoration, and test evidence for the specific engagement. No universal RTO, RPO, or response time is promised. | On request |
| SOC 2 readiness | A planned readiness path. Conduit does not claim SOC 2 certification or a completed SOC 2 report; readiness work and timing require owner confirmation. | Planned |
| FedRAMP service selection | Where required, an architecture can be designed around FedRAMP-authorized services. Conduit and its applications are not presented as FedRAMP authorized. | On request |
| Accessibility acceptance | Offer WCAG 2.1 AA as an agreed acceptance target, with scoped testing and VPAT/ACR delivery planning. No published company VPAT is claimed. | On request |
| Security documentation | Discuss a scoped DPA, SSP summary, NIST 800-53 Moderate control crosswalk, or architecture review. Existing completed documents are not implied. | On request |
| AI-assisted delivery standard | The published standard is proposed and pending owner confirmation. Customer permissions, human review, and acceptance evidence must be agreed before use. | Planned |
Make acceptance measurable.
We offer WCAG 2.1 AA as a delivery baseline, with accessibility acceptance criteria and a VPAT/ACR delivery plan agreed before go-live. This is a proposed engagement standard, not a claim of a published conformance report.
Website accessibility statementSoftware procurement checklist
Support terms belong in the contract.
Use a P1–P4 severity model to define intake, escalation, updates, and restoration objectives. Critical intake coverage and monthly availability targets must be agreed per contract; no standard response times are promised here.
| Priority | Illustrative incident | Targets / coverage |
|---|---|---|
| P1 | Critical service interruption or security incident | Set per contract |
| P2 | Major workflow blocked; service partly available | Set per contract |
| P3 | Limited issue with an available workaround | Set per contract |
| P4 | Question, routine request, or planned change | Set per contract |
AI governance, with human decisions.
The website’s search runs on the visitor’s device and returns source links and excerpts. It does not generate answers or send search queries to an AI provider.
Our proposed delivery standard describes approval, data boundaries, human code review, and verification. Owner confirmation is required before those proposed practices become a statement of current company policy.
Read the proposed AI commitmentsAsk about the evidence you need.
Discuss a DPA, System Security Plan summary, architecture review, incident-response plan, disaster-recovery plan, or accessibility report as part of procurement. Confirm availability and scope before relying on any document.
Ask a security questionResponsible disclosure
Start a conversation
Let’s make the complex work better.
Tell us where the work gets stuck. We’ll start with the workflow, the people, and the constraints.