Privacy Policy

Effective date: July 5, 2026

ComplianceLattice (“we,” “us,” or “our”) is operated by Port City Technology, LLC. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the ComplianceLattice web application and website at compliancelattice.com (collectively, the “Service”).

1. Information We Collect

Account information. When you create an account we collect your name, email address, and a hashed version of your password. We never store plaintext passwords.

Organization data. Information you provide about your agency or organization, including name, size, and compliance status.

Compliance content.Documents, evidence files, policies, control responses, and other materials you upload or create within the Service (“Customer Data”).

Usage data. Server logs including IP address, browser type, pages visited, and timestamps. We do not use third-party analytics trackers.

Payment information. Billing is processed by Stripe. We do not store credit card numbers on our servers. See Stripe’s Privacy Policy for details on how Stripe handles payment data.

2. How We Use Your Information

  • Provide, operate, and maintain the Service
  • Authenticate your identity and manage your account
  • Process transactions and send billing-related communications
  • Send service-related notifications (expiring evidence, task reminders, audit deadlines)
  • Respond to support requests
  • Improve the Service based on aggregated, de-identified usage patterns

We do not sell, rent, or share your personal information or Customer Data with third parties for their marketing purposes.

3. Data Storage and Security

Customer Data is stored in encrypted PostgreSQL databases hosted in the United States. Evidence files are stored in Amazon S3 with server-side encryption (AES-256). All data in transit is encrypted via TLS 1.2 or higher.

Passwords are hashed using scrypt with parameters that meet or exceed OWASP recommendations. Session tokens are stored as SHA-256 hashes; the raw token exists only in the user’s browser cookie.

While no system is 100% secure, we implement administrative, technical, and physical safeguards designed to protect your data against unauthorized access, alteration, or destruction.

4. CJIS Compliance Data Handling

ComplianceLattice is designed to help agencies manage their CJIS compliance posture. The Service itself does not process, store, or transmit Criminal Justice Information (CJI) as defined by the FBI CJIS Security Policy. You should not upload CJI to the Service.

5. Data Retention

We retain your account and Customer Data for as long as your account is active. If you cancel your account, we will delete your Customer Data within 30 days of cancellation, except where retention is required by law. Aggregated, de-identified data may be retained indefinitely.

6. Third-Party Services

We use the following third-party services:

  • Stripe - payment processing
  • Amazon Web Services (S3) - evidence file storage
  • Resend - transactional email delivery
  • Cloudflare - DNS, DDoS protection, and content delivery

Each third-party service receives only the minimum data necessary to perform its function.

7. Your Rights

You may at any time:

  • Access or update your account information via Settings
  • Export your compliance data using the audit export feature
  • Request deletion of your account by contacting us at [email protected]

8. Cookies

We use a single session cookie (cl_session) that is strictly necessary to authenticate your login. It is httpOnly and Secure. We do not use advertising or tracking cookies.

9. Children’s Privacy

The Service is not directed at individuals under 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by placing a prominent notice within the Service. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

11. Contact

If you have questions about this Privacy Policy, contact us at: [email protected]

Port City Technology, LLC
Wilmington, NC