Trust center

• Your audit log is tamper-evident. Every entry is chained to the one before by a SHA-256 hash, and the database refuses to change or delete entries. The audit log API returns each entry's hash and the previous one's, so you can recompute the chain and see that nothing in the middle was altered or removed. Owners and Admins can see the log under Account → Audit log.
• Where the data came from is public. Every bill and official has a Record history, linked from its page: each value we recorded, when, what it replaced and why — with figures CapitolMath calculates itself marked as ours. No account is needed, and it's available as JSON.
• Your data reaches an AI model only when a member of your organization uses an AI feature or receives the Weekly digest. Then only what that request or digest needs is sent, to Anthropic, which may not train models on it. An Owner or Admin can turn off AI writing of the digest. Every model call in the application goes through one module, and a check in our build fails if code anywhere else calls a model. Our data pipeline also uses AI on public legislative text, which involves no customer data.
• CapitolMath staff access shows up in your log. When a member of our staff opens your account or changes it, that is recorded in your audit log, where you can filter for it.
• What you were licensed for is on record. Every change to your plan's limits is written to a history and to your audit log, so what you were entitled to on any date can be shown, not reconstructed.

Daily anchoring of the audit logs to a public repository and independent archives isn't live yet. When it is, each day's fingerprint will be listed here.

CapitolMath doesn't hold SOC 2, ISO 27001 or any other certification yet. We'll list any we earn here, with the report available under NDA. Until then, this page, our security practices and your questionnaire are the basis for review.

Everything runs on DigitalOcean in the United States: the web application on App Platform, a managed PostgreSQL database, one server for the data pipeline and webhook delivery, and Spaces for file storage and downloads. Customer data isn't stored outside the United States.

• All traffic to CapitolMath is encrypted with TLS. The database is encrypted at rest by DigitalOcean.
• API keys are shown once and stored only as a keyed hash (HMAC-SHA-256); nobody at CapitolMath can read a key back.
• Webhook signing secrets are encrypted in the database with AES-256-GCM. Invitation links are stored only as hashes.
• Passwords are handled entirely by our sign-in provider, PropelAuth. They never reach CapitolMath.
• Card details go straight to Stripe. CapitolMath never sees them.

• Sign-in is run by PropelAuth. Single sign-on through your identity provider — Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud and others, by SAML or OIDC — is included in the Pro and Scale plans, and turned on for your account by CapitolMath staff. Once it's live it is required for everyone in the account and your email domain, new people are added on their first sign-in with the role your identity provider assigns, and one named Owner keeps another way in, recorded in the audit log whenever used.
• Each member has a role — Owner, Admin or Member — that decides what they can manage, and separately a license — Full or Basic — that decides what they can do with the data. Roles and licenses lists exactly what each allows.
• API keys belong to the account, carry only the scopes they were given, and can be revoked at any time. Reading the audit log through the API is a separate scope that only Owners and Admins can grant.

Our policy is that staff reach customer accounts only through the application — never by querying the database — for support. Each time staff view or change your account, the event appears in your audit log as CapitolMath staff viewed this account or changed account details.

• What we hold, why, and for how long: the data map and retention schedule.
• Who processes it for us: DigitalOcean, PropelAuth, Stripe, Resend, Anthropic, Mapbox, U.S. Census Bureau. The subprocessor list says what each does, and you can ask to be emailed before it changes.
• When an account closes, its data is deleted within 90 days, and its audit log is erased whole at 90 days unless a legal hold applies. The DPA commits to this.

We commit to 99.5% monthly availability for the application and API, with support response times by severity — see the service level. A probe on a separate server checks the application once a minute, and the last 90 days are public on the status page.

• No independent penetration test has been done yet. We'll say here when one has, and share the summary under NDA.
• Every change is reviewed through a pull request and must pass automated checks — types, lint, the audit-log and AI-boundary checks, tests and a full build — before it can merge.
• Dependencies are watched for security advisories, and updates are proposed automatically.
• Found a vulnerability? See how to report it.

CapitolMath is built to meet WCAG 2.2 Level AA. Our accessibility conformance report (VPAT® 2.5, WCAG edition) rates each success criterion, says how it was evaluated, and lists anything not yet met.

Every whip count is recorded before anyone sees it, in a log that can only be added to, and scored against the official roll call once the vote happens. How it's scored, published and, when a chamber's whip counts do worse than their baseline, withdrawn is set out in advance in the accuracy methodology, before the first results are published. The results are on the accuracy scoreboard.

• Security practices and vulnerability disclosure
• Privacy policy, with the data map and retention schedule
• Terms of service
• Data processing agreement
• Service level
• Subprocessors
• Accessibility conformance report (VPAT®, WCAG 2.2)
• Accuracy scoreboard and its methodology