ZERO-CUI SECURITY

Built on a Strict Zero-CUI Architecture

TeamingIndex.com is engineered from the ground up to protect sensitive defense industrial base metadata. We enforce a strict Zero Controlled Unclassified Information (CUI) storage policy: System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), and DD Form 254 documents are never stored on our servers. Compliance verification records only cryptographic certificate metadata, assessor identifiers, and expiration dates, while our Two-Table Isolation Engine guarantees that nightly federal API syncs update your public contract award totals without ever overwriting your team's curated capabilities or verified security credentials.

How verification works Report a vulnerability

ZERO-CUI STORAGE

What we store, and what we never store

Verification works from metadata. Reviewers look at evidence on a screen-share or in a public registry and record what they checked, never the documents.

Recorded: metadata only

CMMC level, assessment type, C3PAO name, and certification, expiry and affirmation dates
CMMC certificate unique ID, visible only to your team, platform administrators and NDA counterparties
SPRS assessment date and confidence level, and your summary score, which stays private unless you publish it
Facility clearance and safeguarding levels, SCIF capability and the cognizant DCSA office
DDTC (ITAR) registration status and expiry, ISO/AS certificate names, DCAA and FedRAMP status
Verification records: what a reviewer checked, who reviewed it, when, and when it lapses

Never stored

System Security Plans (SSPs)
Plans of Action and Milestones (POA&M) spreadsheets
DD Form 254s (contract security classification specifications)
CUI-marked documents or text, and classified information
Export-controlled technical data (ITAR / EAR)
Uploaded files of any kind: there are no file-upload endpoints

Learn more about CUI and Zero-CUI practices

SECURITY CONTROLS

How the platform protects your data

These controls are built into the product itself, not just written into a policy.

Two-Table Isolation

Federal sync jobs write only to the SAM.gov and USAspending tables. Your capabilities, compliance profile, contract vehicles and verification records live in separate protected tables the sync can never overwrite, truncate or reset, and the claim and plan fields on your organization are off-limits to it too.

Blind SPRS brackets

Unless a contractor chooses to publish it, an exact NIST SP 800-171 score never reaches the search index, JSON-LD, Markdown twins, MCP results or logs. Search sees only cumulative brackets such as SPRS ≥ 85, so primes can filter on posture without seeing the number.

Learn more

NDA-gated score reveal

An exact score is shown only when the contractor publishes it, to the contractor's own team, to platform administrators, or after a mutual NDA is recorded between exactly those two organizations: an accepted teaming request, or an NDA-stage pitch on a Teaming Board post.

Zero-CUI text guard

Every free-text field (profiles, board posts, pitches, requests and AI prompts) is screened before it is saved, sent or indexed. CUI banners and portion markings, classification markings and export-control legends are rejected with a plain explanation.

Learn more

Encrypted secrets, hashed tokens

Integration keys and Enterprise bring-your-own Anthropic keys are encrypted at rest with AES-256-GCM and only ever shown by their last four characters. Session tokens, sign-in links and API keys are stored only as SHA-256 hashes and compared in constant time; sign-in links expire after 20 minutes and work once.

Audit trail and abuse controls

Claims, credential decisions, plan changes, NDA transitions, API key events, administrator role changes and settings changes are written to an append-only audit log (metadata only). Sign-in, claims, teaming requests and the API are rate-limited, and business-development email and phone numbers are visible only to signed-in users.

Public-safe machine outputs

JSON-LD, Markdown twins and MCP results are built from the same public-safe profile view as the web page: an exact SPRS score appears only when the contractor has published it, and CMMC certificate IDs never do. The REST API applies the web's reveal rules to the organization that owns the key, and every data request to the API or MCP server needs a key and is metered.

Exclusion screening built in

SAM.gov registration health and exclusion flags sync nightly. Entities with an active exclusion are hidden from default search and flagged wherever they appear, so an excluded firm does not land on a bid team by accident.

U.S. hosting, encrypted transport

TeamingIndex runs in the United States on a dedicated server. The database, search engine and job queue accept connections only from the server itself, never from the internet. All traffic uses HTTPS with HTTP Strict Transport Security, pages refuse to be framed by other sites, and database backups are kept for 14 days.

AI DATA HANDLING

How the AI analyst handles your data

The AI analyst is powered by Claude. It works from platform data, not from your private records.

Analyses run on Anthropic’s Claude API; Anthropic processes these requests as our subprocessor.
Prompts contain only the platform data a task needs (public-safe profile facts, match results, and award and solicitation facts) plus any text you choose to paste.
Private SPRS scores are never sent to the model; for those it sees blind brackets only.
Pasted text is screened for CUI, classification and export-control markings before anything is sent.
The analyst is told to name only organizations from the candidate list we supply, and any UEI in its answer that was not in that data is flagged as unverified.
Saved reports belong to your organization; the author or an organization administrator can delete them at any time.
If your Enterprise Capture organization connects its own Anthropic API key, the key is stored encrypted and never shown in full.

Treat every output as a first draft

Check AI analyses against the solicitation and your own records before anything goes into a proposal, and never paste controlled information into a prompt.

Learn more

What we do not claim

Because TeamingIndex never stores CUI, it is not a CUI enclave, and we do not claim CMMC certification, FedRAMP authorization or a NIST SP 800-171 assessment for the platform itself. Verified badges describe the contractors listed, not TeamingIndex.

RESPONSIBLE DISCLOSURE

Report a vulnerability

If you believe you have found a security issue in TeamingIndex.com, its API or its MCP server, please tell us privately first.

Email the steps to reproduce, the affected URL or endpoint, and the impact you observed. We appreciate good-faith research that follows these guidelines:

Test only against your own account and organization.
Do not access, change or delete other users’ data; stop and report as soon as you reach someone else’s information.
No denial-of-service, load or spam testing, and no social engineering of our team or users.
Give us reasonable time to fix the issue before you disclose it publicly.

Never include CUI, classified information or export-controlled data in a report.

Security contact

We acknowledge every report and keep you updated while we investigate. We do not run a paid bug bounty program.

security@teamingindex.com

Prove compliance without exposing it

Claim your profile to publish verified badges and blind SPRS brackets, or search partners who already meet your solicitation’s gates.

Claim Your UEI Profile — Free Search the Index