Trust Center
Security and compliance,
in plain language
Winston & Miller provides cybersecurity and information assurance consulting to clients with the most demanding requirements. Our own platform is built to the same standards we advise.
Trust resources
Security architecture →
Encryption, tenant isolation, key management, identity, logging, and WAF/DDoS protection explained in plain language.
Audit logging →
Immutable event trail, seven-year retention, hash manifests, and how to verify an export.
Data ownership →
One-click export, no cross-tenant sharing, retention and destruction policy, and legal-hold procedures.
Compliance posture →
NIST SP 800-53 Rev 5 Moderate and SOC 2 Type II control standards — honest evidence-collection status.
Accessibility →
Section 508 ACR in VPAT 2.5 format, axe-core CI results, and manual VoiceOver and NVDA test protocol.
Subprocessors →
Third-party providers that process data on our behalf, with data classes and FedRAMP authorization status.
Vulnerability disclosure →
Responsible disclosure scope, safe-harbor policy, contact information, and response SLAs.
Frequently asked questions
How does Winston & Miller protect client data?
Data in transit is protected by TLS 1.3 (minimum TLS 1.2). Data at rest is encrypted with AES-256. Each client's data is logically isolated; no data is accessible across client boundaries. Access is controlled by role-based permissions on a least-privilege basis, with multi-factor authentication required for all privileged access.
What security and compliance standards does Winston & Miller follow?
The platform is built to NIST SP 800-53 Rev 5 Moderate control standards and SOC 2 Type II control standards. We are in the evidence-collection phase; no certification is claimed. The platform is designed with FedRAMP readiness in mind; no FedRAMP authorization is claimed.
Who are Winston & Miller's subprocessors?
Our primary subprocessors are 25 Alpha LLC (platform hosting and operations, AWS us-east-1), Amazon Web Services (cloud infrastructure, us-east-1), an email delivery provider, an e-signature provider, and a telephony provider. The full list with data classes is on the Subprocessors page.
How do I report a security vulnerability?
Email jessica@winstonandmiller.com with "Security Vulnerability Report" in the subject line. We acknowledge reports within three business days and provide an initial assessment within ten business days. Researchers acting in good faith are protected under our safe-harbor policy.
Is the Winston & Miller website accessible?
Yes. The site targets WCAG 2.2 Level AA conformance, with Section 508 applicability documented in our Accessibility Conformance Report (ACR) in VPAT 2.5 format. Accessibility is tested in CI with axe-core and validated manually with VoiceOver and NVDA on supported browsers.