HECVAT-Lite style answers

StrategyHub™ is a multi-tenant SaaS strategic planning and strategy execution platform. Customer data consists of strategy content (vision, goals, initiatives, nested actions, KPIs and measurements, budgets, risks, milestones, wins, comments, attachments), account data (names, email addresses, organization membership, role assignments), and operational data (audit log entries, notification records, integration configuration).

No. StrategyHub is not designed for and should not be used to store PHI, payment card data, FERPA-restricted education records, or classified information.

Progress Partners Consulting LLC (DBA Gamechangers Consulting LLC), a U.S. entity. Security contact: security@strategyhub.io. Privacy contact: privacy@strategyhub.io.

No. Not currently in scope or in progress. The underlying platform and infrastructure providers maintain their own audit programs; their reports are available from them under NDA.

No.

No. Internal automated security scanning and row-level-security policy review are performed continuously, including a nightly automated sweep. An external penetration test has not yet been commissioned.

No. Do not procure StrategyHub for workloads that require these authorizations.

The production PostgreSQL database and all file storage are hosted on Amazon Web Services in us-west-2 (Oregon, United States).

Yes. A U.S. front door is available at strategyhub.io in addition to the managed platform origin, and individual workspaces can be pinned to it when a contract requires it.

Backups are managed by the platform provider within the same AWS region. StrategyHub does not currently have a contractual instrument pinning every subprocessor's processing region to the United States, though production data storage is in-region.

No. Backups are managed by the platform provider; recovery objectives are not contractually stated and disaster recovery test evidence is not published.

Yes — Okta, Microsoft Entra ID and Google Workspace, available on the Enterprise plan.

Yes. TOTP MFA is available to every user, with an email step-up verification fallback. Workspace admins can require MFA for all members of their workspace.

Yes. IP and CIDR allowlisting is configurable per workspace and enforced server-side on every authenticated request.

Roles are Admin, Goal Owner, Initiative Owner and Viewer, plus per-goal permission grants. Roles are stored in a dedicated authorization table — never on the user profile — and evaluated by a security-definer database function, so authorization is enforced in the database rather than only in the UI.

No. Anonymous sign-up is disabled; workspace membership requires an invitation.

Each customer organization is a distinct tenant. Isolation is enforced by PostgreSQL row-level security policies: every read and write is scoped to the requesting user's organization memberships by the database itself, not by application query code. Insert and update policies additionally verify that referenced parent records belong to the same organization, which prevents a record from being re-pointed into another tenant. Table privileges are granted explicitly per role.

No. Webhook secrets, integration tokens, embed tokens, domain verification tokens and API key hashes are not readable through the public data API; only server-side code with elevated privileges can read them.

Yes. TLS for all client-to-application and application-to-database traffic. HSTS, X-Content-Type-Options: nosniff, Referrer-Policy and X-Frame-Options are set on both the managed origin and the U.S. front door.

Yes, provided by the underlying managed database and object storage services.

Yes. Workspace activity is recorded in an audit log capturing who changed what and when, visible to workspace admins.

Yes. It is published at /incident-response and commits to notifying affected workspace admins within 72 hours of confirming an incident where customer data was or may have been accessed, with a one-hour acknowledgement target for critical reports.

Yes. Workspace admins can download a complete machine-readable JSON export of everything their workspace owns at any time from Settings → Data portability. No support ticket is required.

Individual records are deletable in-product by authorized roles. Full workspace or account deletion is performed by StrategyHub on written request to privacy@strategyhub.io and completed within 30 days of verification. On a lapsed subscription the workspace becomes read-only and nothing is deleted for 60 days. Operational logs may be retained beyond customer data deletion for a limited period for security purposes.

No. StrategyHub does not use customer data to train any model. AI features send only the specific strategy text needed for a request, server-side, under a StrategyHub API credential, routed through the Lovable AI Gateway to Google Gemini models. Model-provider retention is governed by that provider's commercial API terms; StrategyHub does not assert a zero-retention guarantee. AI features are optional and per-request.

Not as a standing published document. The application is built on accessible component primitives with semantic markup, keyboard navigation and focus management, but no third-party WCAG audit has been performed. Accessibility questions are answered individually — contact sales@strategyhub.io.