Security Self-Assessment
Last updated: May 28, 2026 · CommTrail, LLC · Sheridan, Wyoming
This document responds to standard vendor security assessment questions. For a signed copy or to submit your organization’s own VSAQ form, contact legal@commtrail.com.
Company & Product
- Company name and legal entity
- CommTrail, LLC — Wyoming limited liability company
- Product name
- Meeting Signup (commtrail.com / signup.commtrail.com)
- Product description
- SaaS platform for managing public meeting speaker sign-up lists. Organizations create meetings; attendees sign up to speak; staff manage the queue in real time.
- Hosting model
- Multi-tenant SaaS. All customer data is logically isolated via row-level security policies. No self-hosted deployment option.
- Cloud provider
- Microsoft Azure (application hosting, email delivery). Supabase on AWS US East (database, authentication, file storage).
- Data residency
- All data stored and processed in the United States. No data transfers outside the US.
Authentication & Access Control
- Authentication methods
- Email/password with bcrypt hashing (via Supabase Auth). Magic link / one-time password (OTP) via email. Passwords are never stored in plaintext.
- Multi-factor authentication (MFA)
- TOTP-based MFA (authenticator app) is available for all user accounts. Organization administrators can require MFA for all team members via Settings → Security. Enforcement is immediate — all users without MFA enrolled are redirected to setup on next login. Users cannot unenroll their own MFA factor while org-level enforcement is active; the org policy must be disabled first by an admin.
- Role-based access control
- Yes. Two roles: Admin (full access, including billing and team management) and Staff (meeting management, no billing access). Roles are enforced at both the API layer and the database layer via RLS policies.
- Principle of least privilege
- Yes. Application uses two Supabase clients: an anon/user client for authenticated operations (respects RLS) and a service role client with elevated privileges (used only in server-side public and cron endpoints).
- Session management
- Sessions managed by Supabase Auth using JWT tokens with a 1-hour expiry and automatic refresh via rotating refresh tokens. Sign-out invalidates all sessions globally (scope: global).
- Password policy
- Minimum 12 characters with complexity requirements (uppercase, lowercase, and a number or special character). Enforced at the application layer via schema validation. Supabase handles hashing (bcrypt).
Encryption
- Encryption in transit
- TLS 1.2 minimum enforced on all connections. Azure App Service enforces HTTPS; HTTP requests are redirected to HTTPS. HSTS header with max-age=31536000 is set.
- Encryption at rest
- Supabase database encrypted at rest using AES-256 (via AWS RDS encryption). Azure App Service storage is encrypted at rest by default. File storage (meeting agenda PDFs) encrypted at rest via Supabase Storage (S3-backed, AES-256).
- Key management
- Encryption keys managed by Supabase/AWS and Azure managed services. CommTrail does not manage encryption keys directly. Application secrets (API keys, connection strings) are stored in Azure App Service configuration, not in source code.
Data Handling
- Data categories collected
- Attendee: name, email (optional), topic, organization (optional), accommodation requests (optional). Staff: name, email, role. Billing: Stripe customer ID (no card data stored by CommTrail — Stripe handles PCI compliance).
- Data minimization
- Email is optional on the public signup form. No data is collected beyond what is necessary for meeting management. IP addresses are used transiently for rate limiting and are not stored long-term.
- Data retention
- Data retained for the life of the account. Deleted within 30 days of account closure. Export available before deletion. Backup retention: up to 90 days in backup rotation.
- Data sharing
- CommTrail does not sell, share, or disclose personal data to third parties for commercial purposes. Data is shared only with Sub-processors necessary to deliver the Service (see DPA Section 9).
- Data subject access requests
- Handled via written request to legal@commtrail.com. CommTrail will respond within 5 business days with a data export or deletion confirmation.
Infrastructure & Operations
- Uptime / availability
- Hosted on Azure App Service with a 99.95% SLA from Microsoft. No formal SLA document published yet (in progress — see CONF-034).
- Backup and recovery
- Supabase daily automated backups with 7-day point-in-time recovery. Azure App Service code deployments are versioned via GitHub Actions CI/CD. Recovery time objective (RTO): best-effort, targeting under 4 hours for critical failures.
- Disaster recovery
- Formal DR plan not yet documented. Application is stateless (all state in Supabase); redeployment from GitHub to a new Azure App Service instance takes approximately 10 minutes.
- Change management
- All code changes go through a documented 6-gate SDLC process (Gate 0: pre-implementation → Gate 5: handoff). Changes are committed to GitHub, pass automated linting/type checking/unit tests/build in CI before deployment.
- Vulnerability management
- npm audit run on each CI build. Dependabot alerts monitored. No formal penetration test has been conducted to date (planned as part of SOC 2 readiness in 2027).
- Security patching
- Application dependencies updated regularly. Azure App Service and Supabase managed services receive security patches automatically from their respective providers.
Incident Response
- Incident detection
- Application errors monitored via Sentry (error tracking). Azure application logs available via Azure Monitor. Target detection time for critical incidents: 24 hours.
- Incident notification
- Affected organizations notified within 72 hours of confirmed breach. Notification sent to Account Administrator email. See DPA Section 8 for full breach notification terms.
- Incident response plan
- Informal incident response process in place. Formal IR plan document is in development as part of SOC 2 readiness program.
Compliance & Certifications
- SOC 2
- Not yet certified. SOC 2 Type II audit is planned for 2027. A security self-attestation letter is available as an interim bridge document.
- ISO 27001
- Not certified. Not currently planned.
- GDPR
- CommTrail acts as a Data Processor. Controller (the organization using the Service) is responsible for GDPR compliance with their attendees. DPA available at /legal/dpa.
- HIPAA
- Not applicable. The Service does not process Protected Health Information (PHI). CommTrail does not sign Business Associate Agreements (BAAs) for the Meeting Signup service.
- FERPA
- Attendee names and topics submitted via the public signup form are not student educational records under FERPA. See the Government & Education Addendum at /legal/government for details.
- PCI DSS
- CommTrail does not store, process, or transmit cardholder data. Payment processing is handled entirely by Stripe, Inc. (PCI DSS Level 1 certified).
Personnel
- Background checks
- CommTrail is currently a founder-operated business. Formal background check policy will be implemented prior to hiring any personnel with access to production data.
- Security training
- Founder maintains current awareness of application security best practices. Formal security training program not yet documented.
- Confidentiality agreements
- All personnel with access to customer data are bound by confidentiality obligations.
Note on SOC 2
CommTrail is a growing company and SOC 2 Type II certification is on our roadmap for 2027. Our Security Attestation Letter is available as an interim bridge document for procurement teams that require a formal security statement.