What Attestly Will NOT Do
Most compliance software encourages startups to over-promise or fake certifications. We operate with radical transparency. Here are our non-negotiable boundaries:
1. We Never Fabricate Third-Party Certifications
Attestly will never claim that you hold SOC 2 Type II, ISO 27001, HIPAA, or FedRAMP certifications unless you provide verified audit reports. When buyer questionnaires ask "Are you SOC 2 certified?", Attestly truthfully reports an Evidence Gap or states your actual current audit status.
2. We Never Guess Unknown Numbers, Dates, or Controls
If an interview question is skipped or unknown, Attestly leaves an explicit [FOUNDER TO CONFIRM: description] marker in the generated document. We never extrapolate or hallucinate retention durations, encryption keys, or employee counts.
3. We Never Store or Exfiltrate Buyer Spreadsheets
Customer spreadsheets (.xlsx, .xls, .csv) are parsed directly inside your browser using client-side JavaScript. Only isolated question text strings leave your device for passage matching. The buyer's full spreadsheet is never uploaded to our servers.
4. We Never Train AI Models on Your Policy Data
Your policies, interview responses, and questionnaire entries are processed strictly in transient memory. Zero customer data is licensed, retained, or utilized for foundational AI model parameter optimization.