How we protect contractor data.
MAS Pilot processes government contractor data. We take that seriously.
MAS Pilot access is reviewed before activation. The statements below describe what is implemented today on the marketing site and the current platform, and what is planned for the production platform. We are explicit about the distinction because contractor data deserves that clarity. MAS Pilot is not FedRAMP authorized, is not represented as suitable for CUI or export-controlled data, and holds no government security certification.
TLS 1.2+ everywhere
maspilot.io is served over HTTPS with TLS 1.2 or 1.3. HTTP requests are upgraded. HSTS is set for 2 years with includeSubDomains; preload.
CSP + anti-framing + nosniff
Content Security Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, and a locked-down Permissions-Policy are enforced on every page.
Only what we need to contact you
The access-request form collects name, phone, work email, company, contract-type category, and an optional 12-character UEI (Unique Entity ID). We do not collect pricing data or cardholder information on the marketing site.
Access-request submissions are handled by our own first-party form handler on maspilot.io and stored in a managed database hosted in a US region. We do not use a third-party form service. Applicant confirmation and internal notification emails are sent through a transactional email provider. A signed Data Processing Addendum will be in place before any contractor pricing or pre-award data is collected.
The marketing form is protected by a bot-protection challenge, a same-origin check, edge rate limiting, and honeypot and timing heuristics to deter automated abuse.
AES-256 for stored data
All stored account data and compliance results will be encrypted at rest using provider-managed keys. Transactional pricing data uploaded for checking is designed to be processed in-memory and not persisted beyond the checking session.
Platform roles, MFA and audit trail
Role-based access, least privilege and multifactor authentication for customer accounts in the customer platform, with application-level audit logs for contractor-impacting actions. Audit logs for covered system and access events are already in use on MAS Pilot's own systems. Independent attestation (SOC 2 Type II) is on the roadmap.
Third-party pen test + attestation
Annual third-party penetration testing and a SOC 2 readiness assessment are planned before production launch. Organizations evaluating MAS Pilot can request the current status under NDA.
If you've found a security issue in anything maspilot.io serves, please report it responsibly before public disclosure. We aim to acknowledge within 3 business days. Safe-harbor: good-faith research — no data destruction, no social engineering, no DoS, no targeting of individual users — will not be pursued legally.
PGP / signed reports: available on request. A machine-readable disclosure policy is published at /.well-known/security.txt.
[email protected] →MAS Pilot's outputs — compliance findings, IFF calculations, SRP exports, FAR/GSAM clause analyses, compliance scores — are analytical software outputs, not legal advice. Contractors remain solely responsible for submission accuracy, certifications under GSAR 552.238-80, and all GSAM and FAR compliance. Consult qualified counsel before relying on any output for a contractual or regulatory submission.