Snapshot 84237
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust center Audits & networkProgramFAQRequest documents SECURITY & COMPLIANCE Security at Pursuit Pursuit's security controls, attestations, and compliance position, documented for information security, privacy, and procurement review. ATTESTATION SOC 2 Type 2 Security category, unqualified opinion HOSTING & RESIDENCY AWS · United States only us-east-2 primary, us-west-2 encrypted backups ENCRYPTION AES-256 / TLS 1.2+ KMS-managed keys, rotated every 12 months IDENTITY SAML SSO · MFA · RBAC Okta, Microsoft Entra ID, Google PERSONAL DATA Business contact only No SSNs, health, financial, or consumer PII AI & CUSTOMER DATA Never used for training No customer data trains Pursuit's models or any third-party model AUDITS & NETWORK SECURITY Testing, monitoring, and defense Cadence, tooling, and targets for the eight controls reviewers ask about first. Vulnerability assessments Continuous GuardDuty and ECR image scanning, weekly authenticated Qualys scans, daily endpoint scans, and third-party scans at least quarterly. Findings prioritized on CVSS v3 with CISA KEV and EPSS. Penetration testing Third-party penetration testing of the production environment at least annually, internal and external. Most recent test September 2026. Results reviewed by management and high-priority findings tracked to closure. The report is released on request under mutual NDA. SOC 2 Type 2 Examined September 1, 2025 through August 31, 2026 by Insight Assurance, a full twelve-month period. Unqualified opinion, no exceptions noted in any test of controls, with continuous control monitoring between examinations. Data security AES-256 at rest across RDS, S3, EBS, MongoDB Atlas and all backups; TLS 1.2+ in transit with HSTS enforced. MFA, salted and hashed credentials, and GuardDuty intrusion detection. Secure VPC infrastructure Production runs in a dedicated VPC; development and staging sit in separate AWS accounts with no shared credentials. Web, application, database and management tiers are segmented; default deny-all inbound and outbound. Secure access controls No standing employee access to production customer data. Access is time-bound, ticketed, and approved case by case, under role-based AWS IAM and Okta assignments with segregation of duties. OAuth for integrations OAuth 2.0 for Salesforce and HubSpot sync; Pursuit never stores your credentials. Sign in with Google or Microsoft; SAML 2.0 and OIDC SSO with Okta and Microsoft Entra ID. Disaster recovery & response Daily full backups plus point-in-time snapshots at 60-minute intervals, retained 35 days and replicated cross-region. RTO and RPO of 24 hours; BC and DR plans tested at least annually. Service status Real-time and historical availability on the status page. status.pursuit.us → Subprocessor change notice Under the US Privacy Law Addendum, customers receive at least ten days' email notice before any new subprocessor is enabled, with a ten-day objection window. Request the current subprocessor list → Security & Privacy Officer Brandon Max, Co-founder and Chief Technology Officer, serves as both Security Officer and Privacy Officer. security@pursuit.us → Public agreements Published in full. No request required. Master Services Agreement →US Privacy Law Addendum →Privacy Policy → Researchers: Pursuit publishes a responsible disclosure policy with legal safe harbor. Reports go to security@pursuit.us, with a five-business-day response commitment, researcher credit, and neutral third-party mediation. SCOPE What Pursuit does not hold Where Pursuit lands on the frameworks reviewers ask about most. IN SHORT The data Pursuit analyzes is public record, not your data. Pursuit monitors approximately 110,000 U.S. state, local, education and special-district entities and files approximately 3,500 public records requests per week. Customers may sync CRM objects so signals can be matched to their accounts. The personal data involved is professional contact information for public officials: name, title, agency, work email, work phone. FedRAMP Not authorized. Pursuit sells to commercial companies that sell into the public sector; it does not host federal agency systems or data. A FedRAMP Moderate authorization program can be initiated if a federal requirement emerges. ISO/IEC 27001 Not certified. Pursuit's information security management system is built against ISO 27002 and NIST CSF control families and is independently examined through SOC 2. Formal ISO 27001 certification is an internal objective rather than a current state; ask your Pursuit contact for the latest status. CJIS Not applicable. Pursuit does not collect, store, or process criminal justice information. A segmented environment can be discussed if a CJIS-adjacent use case arises. PCI DSS Out of scope. Pursuit never handles cardholder data. Payments, where applicable, are processed exclusively through a PCI DSS Level 1 service provider. HIPAA Not applicable. Pursuit is neither a covered entity nor a business associate and does not process electronic protected health information. A BAA can be executed if a future use case requires one. GDPR / UK GDPR Not applicable. Pursuit's data set is U.S. state, local, education and special-district public record. Pursuit does not knowingly collect or store personal data of EU or UK residents, and does not operate in the EU. THE PROGRAM The control program in detail Ten control areas, documented in full. AI & model governance Where AI is used, which providers, and what is never sent. Stated plainly: customer data is never used to train Pursuit's models, and never used to train any third-party foundation model. Pursuit does not train cross-customer models or customer-specific models, and models are not shared between customers. Signal extraction Natural-language and LLM pipelines extract early buying signals from agendas, budgets, minutes and procurement notices Entity resolution Probabilistic matching verifies and enriches public-sector contact records Providers Anthropic, OpenAI (including via Microsoft Azure OpenAI Service), and Google, each contracted as a subprocessor on terms prohibiting training on submitted data, assessed before onboarding and annually thereafter What is sent Publicly available and FOIA-obtained public-sector documents and text Prompt retention Prompts and outputs retained 30 days, then purged, unless extended for a specific support investigation Oversight Nightly automated evaluation against verified ground truth with drift alerts, input validation and outlier detection, in-product human override with a feedback loop, and a source reference behind every model output Security testing AI components assessed against the OWASP Top 10 for Large Language Model Applications; all AI operations emit structured logs to CloudWatch Not used for No decisions about an individual's health, legal or financial position, employment, or access to essential services Attestations & assurance Who examined what, over which period, with what result. Report SOC 2 Type 2, Security trust services category Period September 1, 2025 through August 31, 2026 — a full twelve-month examination period Auditor Insight Compliance LLC, dba Insight Assurance — Tampa, Florida Opinion Unqualified — the system description was fairly presented, controls suitably designed, and controls operated effectively throughout the period Currency Coverage since the examination period is carried by an active management bridge letter, issued with the report. A bridge letter is management's representation, not an auditor's report Subservice orgs AWS and MongoDB, carved out for physical and environmental controls over hosting facilities Risk program Annual comprehensive risk assessment, a maintained risk register scored by likelihood and impact, assigned risk owners, remediation tracked to closure Request the full report under NDA → Company & platform profile The vendor-record facts most intake forms ask for first. Legal entity Pursuit Markets, Inc. — a privately held corporation Established October 2023 Headquarters 112 S Main Street, Suite B, Ann Arbor, Michigan 48104, United States Business model Software-as-a-Service, sold by seat with an annual platform fee System of record “AI-powered Opportunity Intelligence Platform” — the system named in Pursuit's SOC 2 Type 2 report Delivery model Multi-tenant SaaS with logical tenant isolation. Pursuit operates no physical data centers and uses no private cloud Access methods Web application, Chrome extension, bidirectional Salesforce and HubSpot integrations, CSV export, and — for provisioned customers — a GraphQL API and MCP endpoint Primary contact Mike Vichich, Chief Executive Officer Security officer Brandon Max, Co-founder & Chief Technology Officer — serves as both Security Officer and Privacy Officer Contractual position Agreements, privacy terms, audit rights, and insurance. MSA Pursuit's standard Master Services Agreement is published and available in editable form for redline. Term and renewal are set on each Order Form Privacy terms The US Privacy Law Addendum is Pursuit's data processing agreement, covering categories of personal data, prohibition on sale or sharing, subprocessor notice and objection rights, breach notification, and return or deletion on termination Mutual NDA Pursuit maintains a standard mutual NDA and will execute your form. Required before release of the SOC 2 report, penetration test results and policy documentation Right to audit On written request at reasonable intervals, no more than once per calendar year, at your cost Insurance Cyber liability, technology errors and omissions, and commercial general liability coverage is maintained. Certificates naming your organization are issued on request Identity & access control What your admins control, and what Pursuit staff can reach. Available to your administrators Single sign-on SAML 2.0 and OIDC, tested with Okta, Microsoft Entra ID and Google MFA Enforced through your identity provider; configurable password policy for any non-SSO users RBAC Granular, with built-in Admin and User roles Revocation One-click revocation of sessions and API tokens Audit trail Logins and SSO events, MFA challenges, role and permission changes, exports and imports, API calls, integration syncs and system errors, all viewable and filterable in-app Export scoping Administrators select which objects, fields and record filters are in scope; personal-data fields can be excluded. API rate limiting applies Pursuit personnel access Standing access None. Employees have no standing administrative access to production customer data; access is disabled by default Granting access Time-bound, ticketed grants to named Support and SRE staff only, approved case by case by the security team for a specific support purpose Authentication Okta SSO with MFA (FIDO2/WebAuthn or TOTP) for production, console and VPN access. SSH root login disabled; admin ports restricted to authorized IP ranges Access reviews Formal recertification annually, tested without exception in the SOC 2 examination, plus quarterly automated IAM and Okta least-privilege audits Deprovisioning Infrastructure and code-review access removed within one business day of termination; orphaned rights removed within 24 hours Secrets Credentials, API keys and certificates held in AWS Secrets Manager and rotated every 90 days; never hard-coded Infrastructure & app security Network posture, logging, patching, and secure development. Perimeter Default deny-all inbound and outbound; unauthenticated inbound blocked. Security Groups and Network ACLs enforce least functionality; ingress is HTTPS only Protective controls AWS WAF with OWASP Top 10 rule coverage, AWS Shield for DDoS, GuardDuty for threat and intrusion detection, and API rate limiting Firewall governance Rulesets reviewed annually, unnecessary rules removed, administrative access logged. Every service, protocol and port is documented and business-justified Endpoints Company-issued laptops with full-disk encryption, anti-malware with daily updates, automated patching, host firewalls and CIS-benchmark hardening; users cannot disable protection Key management AWS KMS with separation of duties between key-use and key-administration roles. Keys rotated at least every 12 months and never reused after retirement Logging Authentication, administrative actions, access-rights changes, sensitive-data access and exports, network connections, and access to the logs themselves — with actor, object, outcome and NTP-synchronized timestamps Log integrity Backed up to a central log server outside administrator control; administrators cannot erase logs of their own activity, and file-integrity monitoring alerts on tampering Log retention Nine months in hot storage; security documentation and audit trails for a minimum of seven years Monitoring 24×7. Metrics, logs, IDS and endpoint detection feed CloudWatch, with CISA advisories and AWS security feeds as threat intelligence. Alerts route to the on-call Information Security Manager Remediation Critical 48–72 hours · High 3 days · Medium 7 days · Low best effort. No release with an unresolved Critical or High finding without documented approval from both the Security Officer and the asset owner Secure development Pull requests with branch protection, peer review by someone other than the author, static analysis in CI, Terraform infrastructure-as-code, and CTO approval before production promotion Test data Production data is never used in testing or development — synthetic or tokenized data only. Test accounts and default credentials are removed before release People & third parties Screening, training, and how subprocessors are governed. Screening All employees and contractors complete a Checkr background check before start date — identity, criminal history, watch-list and education verification Agreements Confidentiality and non-disclosure agreements signed before access to confidential information, re-acknowledged annually alongside the Information Security Policy, Code of Conduct and Acceptable Use Policy Training Security awareness training within 30 days of hire and annually thereafter, tracked through Drata, plus quarterly phishing simulations and role-based training for engineering, DevOps and support Due diligence Security questionnaires, compliance reports and shared-responsibility analysis before engagement. No vendor accesses Pursuit assets before a security and privacy contract is signed Ongoing review SOC 2, ISO or equivalent evidence reviewed annually for critical vendors, recorded in the vendor inventory and risk register. Vendors are tiered High, Moderate or Low Third-party access Provisioned through SSO with least privilege, logged, reviewed quarterly, enabled only for the authorized window, and revoked at contract end Change notice Any new subprocessor is added to the list and customers are notified by email at least ten days before it is enabled, with a ten-day objection window Residency All subprocessors are United States entities that store and process data within the United States Request the complete subprocessor list → Resilience & incident response Backups, recovery objectives, and what happens in an incident. Backups Automated daily full backups of MongoDB Atlas and Amazon RDS, plus continuous point-in-time snapshots at 60-minute intervals. Infrastructure configuration is version-controlled as code Protection AES-256 via AWS KMS, replicated cross-region within the United States, access restricted to key personnel. Retained 35 days Recovery objectives Stated RTO and RPO of 24 hours, with the DR plan targeting full restoration within 24 hours. Underlying capability is materially tighter — point-in-time recovery at 60-minute granularity Testing Restoration testing verifies recovery capability; BC and DR plans are tested at least annually with documented results and lessons tracked to closure Internal reporting Any employee or contractor must report a suspected vulnerability or incident to the Security Officer within 24 hours; failure to report is a security violation Investigation Preliminary investigation and risk assessment within 48 hours, severity assigned High, Medium or Low, with root cause, evidence and mitigations documented Your notification Operating practice is notification within 24 hours of confirming an incident that affects your data or systems, with details and mitigation steps. The contractual standard is without undue delay Closure Post-incident review with root cause analysis and documented lessons learned. Every incident is logged with disclosures recorded Testing & training The incident response plan is tested annually and all staff are trained on the procedure at least annually Track record The SOC 2 report states that no significant system incidents occurred during the twelve-month examination period, and the current bridge letter confirms management is aware of none since What data Pursuit touches Categories, residency, tenant isolation, retention and deletion. Collected by Pursuit Public-sector entity master data, public documents, agendas, minutes, budgets, procurement notices, contract records, FOIA responses, and professional contact records for public-sector personnel Provided by you Only the CRM objects you choose to sync, SSO identity data, and usage and audit events. You select which objects, fields and record filters are in scope; personal-data fields can be excluded Never collected Social Security or national ID numbers, driver's license numbers, payment card or bank account data, health records, biometric identifiers, precise geolocation, or personal non-work contact details Residency AWS us-east-2 (Ohio) with encrypted backups to us-west-2 (Oregon). All data stays within United States borders at rest, in processing, and in backup Tenant isolation Multi-tenant with logical separation by unique customer identifier, enforced at the API layer — the account identifier is embedded in the access token and every datastore query is scoped by it. No commingling of customer data Retention Retained while the account is active. On closure the account expires and data is permanently removed 30 days later, except where law requires retention. A record of deletion is kept Data return CSV export, Salesforce or HubSpot sync, or an encrypted snapshot on request. On termination Pursuit returns or deletes personal data at your election No sale or sharing Under the US Privacy Law Addendum, Pursuit will not sell or share your personal data, or use it outside the direct business relationship Your responsibilities as a customer Complementary user entity controls, the ones your auditors will look for. Pursuit's SOC 2 report identifies complementary user entity controls — the controls your organization must operate for the overall control environment to work as designed. Your auditors will look for these. User access Maintain controls providing reasonable assurance that user access, including provisioning and deprovisioning, is appropriately designed and operating effectively — in practice, prompt removal of departing users from your Pursuit tenant and correct identity-provider configuration Issue reporting Report issues with Pursuit systems and the platform through the support channels provided Contractual Understand and comply with your contractual obligations to Pursuit Contact changes Notify Pursuit of changes to administrative contact information, so security and incident communications reach the right people Subservice orgs Physical and environmental security of the hosting facilities, and destruction of physical assets, are the responsibility of AWS and MongoDB as subservice organizations. Their controls were not examined in Pursuit's SOC 2 report and are covered by those providers' own attestations COMMON QUESTIONS Questions reviewers send most Access & Identity Do you support SSO? Yes. SAML 2.0 and OIDC, tested with Okta, Microsoft Entra ID, and Google. Setup documentation is published in the Pursuit docs. Do you support MFA? Yes, enforced through your identity provider. Configurable password-policy controls are available for any non-SSO users. Do you support granular RBAC? Yes. Built-in Admin and User roles. Do you support SCIM provisioning? Not today. User management is performed through the admin interface or by CSV on request. Can your staff see our data? Only named Support and SRE staff, through time-bound ticketed access approved case by case. There is no standing production access; exceptions exist only for forensic analysis and manual disaster recovery. Artificial Intelligence Do you use AI? Yes. Signal extraction from public documents and entity resolution. Is our data used to train your models? No. Never, for Pursuit's models or any third-party model. Third-party providers are contracted on terms that prohibit training on data Pursuit submits. Which foundation models do you use? Anthropic, OpenAI (including via Microsoft Azure OpenAI Service), and Google, applied to public-sector source documents. How long are prompts and outputs kept? 30 days, then purged, unless retention is extended for a specific support investigation. Do you train cross-customer or customer-specific models? No to both. Models are not shared between customers. Compliance Do you have a SOC 2 report? Yes. SOC 2 Type 2, Security category, covering September 1, 2025 through August 31, 2026, a full twelve-month examination period. Unqualified opinion, no exceptions noted in any test of controls. The full report is released under mutual NDA. Is the report current? Yes. The examination period ran through August 31, 2026, and coverage since then is carried by an active management bridge letter issued alongside the report. Request both from security@pursuit.us under mutual NDA. Do you have documented security policies? Yes. A full policy set covering access control, encryption, incident response, backup, disaster recovery, SDLC and vendor management. Redacted copies are available under NDA. Do you run a risk management program? Yes. An annual comprehensive risk assessment, a maintained risk register scored by likelihood and impact, assigned risk owners, and remediation tracked to closure. Which control frameworks do you build against? Pursuit's information security management system is built against ISO 27002 and NIST CSF control families and independently examined through SOC 2. Data Where is our data stored? AWS us-east-2 (Ohio), with encrypted backups in us-west-2 (Oregon). All data stays in the United States. Do you operate your own data centers? No, and no private cloud. Pursuit runs entirely on AWS, with MongoDB Atlas co-located in us-east-2. Is the platform multi-tenant? Yes, with logical isolation enforced at the API layer by a per-account identifier. There is no commingling of customer data. Dedicated database or compute resources can be discussed if you have a specific requirement. What personal data do you process? Professional contact information for public-sector personnel (name, title, agency, work email, work phone, public roster URL), plus your users' identity data for SSO. Do you process sensitive personal data? No. No SSNs, health, financial, biometric, or consumer personal information. People, Vendors & Legal Do you background-check staff? Yes. Identity, criminal, watch-list, and education checks through Checkr before start date, for employees and contractors alike. Do you train staff on security? Yes. Within 30 days of hire and annually thereafter, with quarterly phishing simulations and role-based training for engineering, DevOps and support. Do you use subprocessors? Yes, a limited set of U.S.-based subprocessors covering hosting, database, model inference, identity, compliance automation, screening, payments, analytics and email delivery. The complete current list is provided on request. What notice do we get of new subprocessors? At least ten days' email notice before a new subprocessor is enabled, with a ten-day objection window. Do you carry cyber insurance? Yes. Request a certificate of insurance for details. Resilience & Response How often do you back up? Daily full backups plus continuous point-in-time snapshots at 60-minute intervals, retained 35 days and replicated cross-region within the United States. What are your RTO and RPO? Stated objectives of 24 hours for both; underlying recovery capability is finer-grained. No specific RTO or RPO is committed in the standard agreement, so raise it in contracting if you need one. Are BC and DR plans tested? Yes, at least annually, with documented results and lessons learned tracked to closure. Tested without exception in the SOC 2 examination. Will you notify us of a breach? Operating practice is notification within 24 hours of confirming an incident affecting your data or systems; the contractual standard is without undue delay. A specific contractual window can be raised during contracting. Do you run tabletop exercises? Yes. The incident response plan is tested annually and staff are trained on the response procedure annually. Technical Controls Is data encrypted at rest? Yes. AES-256 with AWS KMS-managed keys across databases, object storage, block storage, and backups. Endpoint disks are fully encrypted. Is data encrypted in transit? Yes. TLS 1.2 or higher, terminated at the AWS Application Load Balancer with HSTS enforced. How often are keys rotated? KMS keys at least every 12 months; application secrets every 90 days. Retired keys are never reused. Do you perform penetration testing? Yes. At least annually by a third party, internal and external, with high-priority findings tracked to closure. The most recent test was completed in September 2026. Request the report from security@pursuit.us and it is released under mutual NDA. Do you scan for vulnerabilities? Continuously through GuardDuty and ECR image scanning, weekly authenticated Qualys scans, daily endpoint scans, and third-party scans at least quarterly. REQUEST DOCUMENTS Request the evidence set Items marked NDA are released once a mutual NDA is executed. Pursuit will execute your form. Requests go to the security team, which replies with the documents or a mutual NDA. Attach your SIG, CAIQ, HECVAT or internal questionnaire and Pursuit will complete it. Or email security@pursuit.us Request received. The security team will reply by email. Something went wrong. Email security@pursuit.us and the team will follow up. Still have questions? Send them to the security team, or hand your standard questionnaire to your Pursuit contact. Email the security team Request documents