Security roadmap
What is available now, what is being worked on, and when we next review it. Missing dates mean no date has been committed.
Status overview
Available
1
Validating
1
Implementing
1
Researching
0
Not scheduled
3
Bot protection (CAPTCHA) on public forms remains available.
Review schedule
Planned operating dates for reviewing this roadmap. They are not release dates, completed assessments or certifications.
- First monthly roadmap review (planned)
- Semiannual reassessment (planned)
- Semiannual reassessment (planned)
Monthly reviews continue after each date; semiannual reassessments recur every March and September.
Capabilities
| Capability | State | Current | Next concrete milestone | Owner | Next review | Evidence | Target |
|---|---|---|---|---|---|---|---|
| HECVAT 4.1.6 | Validating | A self-completed questionnaire has been drafted from current evidence. It is a vendor self-assessment, not a certification, audit or institution-approved assessment. | Owner review of the remaining answers; then sharing with requesting institutions on request. | Daniel Petry | October 30, 2026 (planned) | None published | Date not committed |
| Organization SSO | Available | OIDC and SAML 2.0, service-provider-initiated, opt-in per organization after domain verification. Tested against standards-based test identity providers. | First pilot with a customer production identity provider, set up together. | Daniel Petry | October 30, 2026 (planned) | /security | Date not committed |
| Sign in with Google / Microsoft | Implementing | Not available. | Provider registrations are required before it can be offered. | Daniel Petry | October 30, 2026 (planned) | None published | Date not committed |
| HIPAA / BAA | Not scheduled | Not available. | None scheduled. | Daniel Petry | October 30, 2026 (planned) | None published | Date not committed |
| EU data residency | Not scheduled | Not available. Data is hosted in a single United States region. | None scheduled. | Daniel Petry | October 30, 2026 (planned) | None published | Date not committed |
| Customer-held encryption keys | Not scheduled | Not available. Existing storage protections are described under Form data encryption. | None scheduled. | Daniel Petry | October 30, 2026 (planned) | None published | Date not committed |
External assessment
Independent assessments are tracked separately from product capabilities. None is underway.
| Capability | State | Current | Next concrete milestone | Owner | Next review | Evidence | Target |
|---|---|---|---|---|---|---|---|
| Independent penetration test | Not scheduled | No independent penetration test report is available. | No engagement is scheduled. | Daniel Petry | October 30, 2026 (planned) | None published | Date not committed |
| SOC 2 / ISO/IEC 27001 | Not scheduled | Not held. No audit or certification engagement is underway. | None scheduled. | Daniel Petry | October 30, 2026 (planned) | None published | Date not committed |
Change history
- — Standalone roadmap page published with review schedule and owners. Google/Microsoft sign-in moved to Implementing (built, switched off until provider registration).
This roadmap is not a contractual commitment. Questions: use the contact form or [email protected].