SECURITY AND PRIVACY AT PROJECT BASELINE

AT A GLANCE

The short version. Each card links to the detailed section below.

COMPLIANCE AND POSTURE

Honest framing: we are a solo consulting firm. We are not currently SOC 2 Type II attested, ISO 27001 certified, HIPAA-attested, or PCI-DSS attested. We do not represent ourselves as such. What we are is a single-operator practice that has implemented and documented controls aligned with the NIST Cybersecurity Framework 2.0 (NIST CSF 2.0), scaled appropriately for our size and scope.

NIST CSF 2.0 alignment

We operate against the six NIST CSF 2.0 functions:

• Govern (GV): Information Security Policy, Vendor and Sub-Processor Management Policy, Risk Register, annual review cadence
• Identify (ID): PB Security Inventory documenting every system, sub-processor, data flow, and identified gap (last updated 2026-05-22)
• Protect (PR): Access Control Policy (MFA on all SaaS accounts, SSH key-only on infrastructure), Cryptography Policy (TLS 1.2+, bcrypt cost factor 12, AES-256 at rest where applicable), Acceptable Use Policy, Data Retention Policy, Backup Policy
• Detect (DE): Structured logging on infrastructure, sub-processor security alerts (GitHub, Cloudflare, Stripe, Google Workspace, DigitalOcean), application-level abuse-control telemetry
• Respond (RS): Incident Response Plan with 72-hour breach notification SLA
• Recover (RC): Backup Policy (encrypted, off-site, 90-day rolling retention plus annual archives), documented restoration testing cadence

Certifications and attestations

• SOC 2 Type II: Not currently attested. Not on roadmap for 2026 (size and scope do not justify cost).
• ISO 27001: Not currently certified.
• HIPAA: Not applicable. We do not process Protected Health Information.
• PCI-DSS: Not directly applicable. Payment card data is processed by Stripe (PCI-DSS Level 1 attested); PB never receives or stores cardholder data.
• GDPR, UK GDPR, CCPA, and other US state privacy laws: We honor data subject rights under these laws. See Privacy Policy.

If our service stack grows to a scale where a formal attestation makes sense for the business, we will pursue it and update this page.

SUB-PROCESSORS

The vendors below process PB-controlled data on our behalf. Each is selected with documented risk assessment, contractual protections through their Data Processing Addenda or equivalent commitments, and ongoing monitoring. We notify clients with active engagements at least 30 days before adding a new sub-processor that will process their data.

Sub-processor change subscription: Clients with active engagements receive direct notice at least 30 days before any change to the active sub-processor list affecting their data. To subscribe to notifications, email [email protected] with the subject line "Sub-processor notifications."

HOW WE HANDLE DATA

Encryption, retention, and deletion. The short version below; the full schedule lives in our Data Retention Policy (downloadable in the Policies section).

INCIDENT RESPONSE

If we confirm a security incident that affects your information, we notify you within 72 hours of confirmed exposure. Notification includes what happened, what information was involved, what we are doing about it, what you can do, and how to contact us with questions.

Severity-based response targets

Notification channels: Direct email from [email protected], with a follow-up call within 24 hours of email for Sev-1 incidents.

Our complete Incident Response Plan (severity definitions, response phases, contact list, communication templates) is downloadable in the Policies section below.

PRIVACY

We do not sell or share your personal information for advertising. We do not use cross-site tracking or third-party advertising cookies. We do not use your information to train artificial intelligence models, and we contractually prohibit our AI sub-processors from doing so.

You have the right to access, correct, delete, and export your personal information. California residents have additional rights under the CCPA. Residents of the EEA, UK, and Switzerland have additional rights under GDPR. We respond to privacy requests within 7 days of receipt and complete most requests within 30 days.

Full Privacy Policy: www.project-baseline.com/privacy

To submit a privacy request: Email [email protected] with the subject line "California Privacy Request," "GDPR Request," or "Privacy Request" as applicable.

POLICIES AND DOCUMENTATION

The complete PB security policy bundle is below. These are the documents we operate by; they are also available to clients and prospects on request.

Some clients and prospects may need versions with additional detail (controls evidence, audit logs, environment-specific configuration). Request extended versions by email; we will evaluate the request and respond within 7 days.

CONTACT

All security, privacy, and general inquiries route to a single email address. We acknowledge security reports within 24 hours and privacy requests within 7 days.