How Tiermark protects what you put in it

Accounts

Multi-factor authentication is required on every account, with no way around it. A person signs in with a password and an authenticator code, or with a passkey; SMS codes are not offered. Passwords are at least 14 characters.

Where your data lives

Everything is stored in Tiermark’s own Amazon Web Services account in the United States, in the Ohio region (us-east-2). Data is encrypted in transit, with TLS 1.2 or later at the edge and TLS enforced on every storage bucket, and at rest.

The audit trail

Every change in your organization is written to an audit trail that nobody, Tiermark included, can edit or delete. Each event carries a hash that links it to the one before it, and a copy of each event is written once to a mirror that pages on any change. Once a day, an anchor seals every organization’s chain head, and two outside time-stamp authorities (Sectigo and DigiCert) are asked to sign the anchor’s hash under RFC 3161. Checking a day’s anchor against its time-stamp takes openssl and the public root certificates alone; nothing in the check depends on trusting Tiermark.

A signed answer set is written once, with a SHA-256 content hash computed at signing, and Tiermark refuses to read one whose bytes no longer match. Audit packages are kept in object-locked storage, so the copy you hand over and the copy Tiermark holds are the same file.

Least privilege

A session in the console is tagged with your organization, company and role, and can reach only your organization’s own partitions. Only named services may append to the audit ledger, and no role may update or delete an event in it. The application’s own role holds no IAM or key-administration rights.

No CUI, ever

Controlled Unclassified Information, classified information and export-controlled technical data may not be submitted, and the platform is not built to hold them. Every text a person writes, from questionnaire answers to risk items, campaign notes and workspace entries, is checked for a controlled-information marking before it is stored: a banner line, a portion marking or a designation indicator block is refused, before a draft is saved and again at signing. If CUI is found, it is deleted.

Grades are passive

A grade comes from public DNS, mail authentication, certificate and TLS signals, read the way any visitor to a domain could read them. Nobody’s systems are probed. Active testing happens only with written authorization from the owner of the system. How a grade is worked out.

Who else processes your data

AWS (hosting), Stripe (payments; card details never touch Tiermark’s systems), Google Workspace (business email) and Anthropic (the model behind Terry, the support assistant, which runs in the United States and does not train on what it is sent). Nobody else, unless the law requires it. If you came from a Google ad, Google may be told that the click led to a sign-up, by Google’s own identifier for that click and the time, with nothing about you or your organization. The privacy notice has the details.

Reporting a vulnerability

Write to security@tiermark.io. Do not probe Tiermark’s systems without written authorization; tell us what you found. If we learn that information about you has been exposed, we will tell you without unreasonable delay.