Built for the controls your procurement team will ask about.
A plain-English summary of how Commun-ET protects customer data across the marketing site, PermitPilot application, and supporting services. For a vendor questionnaire or detailed security review, contact our team.
Core controls
Every database table enforces row-level security policies. Users only see data their role and identity entitles them to, enforced at the database, not just in app code.
Roles are stored in a dedicated table and resolved through a SECURITY DEFINER function, eliminating the privilege-escalation paths that come with role flags on user records.
All data is encrypted at rest with AES-256 and in transit with TLS 1.2+. Backups inherit the same encryption guarantees.
The primary database runs daily encrypted backups with 7-day point-in-time recovery, so a misclick or bad migration is never a one-way door.
Privileged actions, admin grants, invite issuance, configuration changes, are written to an append-only audit log that admins can review and export to CSV at any time.
Passwords are checked against the Have I Been Pwned database during signup and reset, and we enforce minimum length and complexity floors.
SAML SSO is available on enterprise plans alongside Google sign-in. We can map IdP groups to PermitPilot roles for centralized provisioning.
Public lead-capture and signup flows are protected by Cloudflare Turnstile, server-side honeypots, per-IP throttling, and disposable-email blocking.
Operating principles
- Least privilege by default, every new table starts with deny-all RLS until policies are written.
- No secrets in client code. Service-role credentials live only inside server-side edge functions.
- Server-side validation on every public write, even when client-side validation already ran.
- Security findings are tracked and remediated, not deferred indefinitely.
Compliance & process
Hosted on SOC 2 Type II compliant cloud infrastructure (AWS, via Supabase). Region pinning available on enterprise plans.
We support data export and deletion requests on request. Contact privacy@commun-et.com to initiate one.
Disclose security issues to security@commun-et.com. We acknowledge within 2 business days and coordinate fixes responsibly.
Need a deeper review?
We respond to vendor questionnaires, MSA negotiations, and SIG-Lite reviews on enterprise procurements. Tell us what your team needs.