Privacy notice

Tiermark is built and operated by Edwards Consulting Group, Swansboro, North Carolina (“we”). This notice says what we collect when you use tiermark.io, why, where it lives, who else sees it, and how to have it corrected or deleted. It is written to be read. If anything here is unclear, write to help@tiermark.io and a person will answer.

What we collect, and why

The free report request. When you ask for an exposure report we collect the work email address and company name you type, and a one-way hash of your network address to limit abuse of the form. We use the address to reply to you and to send the report. It goes on no list and receives no drip campaign.

An account. If you sign in, we collect your email address, the credentials you choose (a password with an authenticator code, or a passkey), and a record of sign-ins. Multi-factor authentication is required; we do not offer a way around it.

What you put in the platform. Supplier lists, attestations, evidence you choose to upload, and the messages you send through it. You decide what goes in. Controlled Unclassified Information (CUI), classified information, and export-controlled technical data may not be submitted; the platform is not built to hold them and we will delete them if found.

Public records about companies. Most of what Tiermark shows comes from public sources: SAM.gov registrations and exclusions, USAspending award and subaward records, the Consolidated Screening List, and the public DNS, mail-authentication, certificate and TLS configuration of company domains. These describe companies. Where a public registration names a business point of contact we do not collect that person’s email address.

Server logs. Our web infrastructure records the network address, browser type, and pages requested, as every web server does. We keep those logs for about thirteen months for security and troubleshooting.

Payments. Card and bank details go directly to Stripe, our payment processor, and never touch our systems. We receive the customer record, invoices, and payment status.

Terry, our AI assistant. When you ask Terry a question in the console, your browser keeps the conversation for that visit. To answer, Terry reads your question, our help center and your own organization’s account, read-only. It sends your question, the conversation so far, the help articles it needs and that account summary to Anthropic, whose Claude model writes the answer in the United States. Anthropic does not use what it is sent to train its models. If you or Terry hands the conversation to a person, we keep the conversation so far with your organization’s records so that person can follow up.

What we do not do

• No advertising or analytics trackers. The only cookie is the session cookie set when you sign in. If you arrive through a link that carries campaign tags (an advertisement’s, for example), your browser keeps those tags and the site you came from for that visit only, in its own storage rather than a cookie, and sends them with a report request, or with your organization when you create one, so we know which campaigns bring requests and customers. We keep them with the request or the organization. If you came from a Google ad, we may tell Google that the click led to a sign-up, using only Google’s identifier for that click and the time; nothing about you or your organization goes with it. We share them with no one else.
• No selling, renting, or trading of personal information, ever.
• No scanning of anyone’s systems beyond passive observation of public records. Active testing happens only with written authorization from the owner of the system.
• No use of the information you give us to train anyone’s artificial intelligence model.

Where it lives and who can reach it

Everything is stored in our own Amazon Web Services account in the United States, encrypted in transit and at rest. The people who can reach it are the people who operate Tiermark. Service providers who process data on our behalf are AWS (hosting), Stripe (payments), Google Workspace (our business email), and Anthropic (the AI model behind Terry, our assistant). We share information with no one else unless the law requires it, and if it does we will tell you when we are allowed to.

Information you put in the platform is visible to the people you share it with by design: a supplier’s attestation is visible to the prime that requested it, and a company’s public-record grade is visible to the customers who list that company as a supplier.

How long we keep it

A report request is kept until you ask us to delete it or until it is plainly no longer needed. Account and platform data are kept while the account is open and deleted or returned when it closes, except for the audit record of what was accepted and when, which is kept because it is the record. Server logs expire on the schedule above.

Your choices

Write to help@tiermark.io to see what we hold about you or your company, to correct it, to have it deleted, or to have your company removed from any directory we publish. We answer within ten business days and usually sooner. Every email we send has a way to stop further email.

If a grade or a report about your company is wrong, tell us the same way. A grade is our reading of public signals; if the public record has changed, we re-read it.

Security

Encryption everywhere, multi-factor authentication for every account, least-privilege access inside our own systems, and an immutable audit log. If we ever learn that information about you has been exposed, we will tell you without unreasonable delay. Security questions and reports go to security@tiermark.io.

Who this is for

Tiermark is a business service for companies and the people who work for them. It is not directed at anyone under eighteen and we do not knowingly collect information from them.

Changes

When this notice changes, the date at the top changes and account holders are told at their next sign-in. We will not change it to permit something this version says we never do without asking first.