This revision takes effect November 2, 2026. Until then the September 12, 2026 version (last updated October 17, 2026) remains in force. Section 14 lists what changed.

Hydromation Corporation ("Hydromation," "we," "us," or "our") operates CMMC Map, also styled CMMCMAP, at cmmcmap.com and app.cmmcmap.com. This Privacy Policy explains what data we collect, how we use it, who else touches it, and your rights regarding that data. It covers the public website, the application, and the learner portal where a customer's personnel complete training and acknowledge policies.

1. Information We Collect

Account information: When you create an account we collect your name, email address, company name, and a password (stored only as a hash). Accounts created before October 18, 2026 also gave a phone number, which we keep with the account. If you sign in with Google or Microsoft, we receive your name and email address from that provider and no password is created.

Workspace content: The answers, statuses, written responses, evidence notes, and documents you generate inside your workspace. This is your organization's data and stays in your workspace.

Uploaded files: Documents and evidence files you upload are stored in your organization's private workspace so you can manage them alongside your assessment. They are protected by row-level security and you can delete them at any time. Uploaded files are not analyzed by AI unless you explicitly request it for a specific file (see Section 3).

Evidence connectors: If you connect Microsoft 365, Google Workspace, or Microsoft Sentinel (see Section 4), we store the read-only credentials you supply, encrypted at rest, and the configuration and metadata the connector reads from your tenant, filed as evidence in your workspace.

Team and client contacts: When you invite a colleague, or a consultant sends a question to a client contact, we store that person's email address and name so the invitation or question can be delivered and their reply recorded.

Personnel records: If your workspace uses the People features, the roster you keep of your organization's personnel: each person's name, email address, title, department, audience, start and end dates, where the record came from (typed in, a CSV upload, a Microsoft 365 or Google Workspace directory import, or an app sign-in), and their training, policy acknowledgment, and certificate records. These are records about your personnel that you choose to keep in CMMC Map; Section 7 explains how they are handled.

Usage data: How you use the platform, such as pages viewed, documents generated, progress scores, sign-in activity, and session activity. Used to provide the service, keep it secure, and improve it.

Billing information: Payment processing is handled by Stripe. We do not store card numbers or bank details. We receive limited transaction metadata (last four digits, billing postal code, subscription status) from Stripe.

Security and technical data: IP address, browser type, referring URL, and the outcome of sign-in attempts. Failed sign-ins, blocked sign-ups, password resets, and similar events are recorded with the address behind them so we can detect abuse. On the public website, each visit is also recorded once per browser session with the network address, the organization that owns it, its approximate city, hosting or proxy flags, the page, the referring page, and the browser type, so we can flag visits from watched locations (see Section 10).

Website forms and events: When you use the contact form, an "email me my result" tool, or the updates box on cmmcmap.com, we receive what you typed (name, email address, company, and your message or result). When you register for one of our webinars or book a demo, Microsoft Teams or Microsoft Bookings collects your registration under Microsoft's terms and passes us your name, email address, and your answers to the registration questions.

Business contact records: We keep a business contact record for people who have contacted us, registered for an event, or held an account: name, email address, company, and notes of our conversations with you, so we can respond to later requests and honor a request not to be contacted.

2. How We Use Your Information

We do not sell your personal data. We do not use your data to train AI models, and our AI provider does not train on it either (see Section 3).

3. AI Features and Third-Party APIs

CMMC Map offers optional AI-powered features that draft and explain, using the Anthropic Claude API through our own managed connection. You do not supply an API key. Your generated documents (System Security Plan, Plan of Action and Milestones, policies, and the Readiness Report) are built from templates and the answers you recorded, without AI.

AI features are on when a workspace is created. An owner or admin of the workspace can switch them off in Settings at any time, and that switch is enforced on our servers. Even when enabled, nothing is sent to the AI provider unless you explicitly invoke an AI action, for example asking the guide a question or clicking an AI-labeled button. AI never sets a control or objective status; a suggestion becomes a status only when you apply it.

What is sent to Anthropic depends on the feature you invoke:

Anthropic processes this content to return a response and, under our API terms with Anthropic, does not use it to train AI models. Your use of AI features is also subject to Anthropic's Privacy Policy. Do not submit CUI or other restricted information to AI features. The model currently in use is named on our AI and your data page.

4. Evidence Connectors, Log Sources, and Log Forwarding

You can connect your Microsoft 365 tenant, Google Workspace domain, or Microsoft Sentinel workspace so the app can file evidence for you. The connection uses read-only credentials that you create and supply. We encrypt those credentials at rest and use them only to read your tenant on your instruction, on the schedule you set, and for the nightly roster check described in Section 7 once you have imported your directory.

What the connector reads is configuration and metadata: user accounts, whether multi-factor authentication is enforced, device and audit settings, sign-in and security policy settings, and file and folder metadata such as names, owners, sharing state, and labels. It does not read the contents of documents, email, or chat. The optional CUI discovery scan records where sensitive content appears to live (file names and locations), not the content itself. From Microsoft Sentinel it reads counts and configuration (connected sources, retention settings, alert rules, and incident counts) through read-only management calls, never a log line or an incident body.

Everything the connector files is labeled with its source and the time it was read. The connector suggests where evidence applies; it never sets a control's status for you. You can disconnect at any time from Settings, which deletes the stored credentials. Microsoft and Google are not our service providers in this arrangement; the connector reads your own tenant under the terms you have with them.

Log sources: you can keep an inventory of your own log sources (name, what each covers, where it lives, its retention, its reviewer, and the review cadence). The app records when each source last showed a signal through a linked connection and emails the reviewer you named when a source may have stopped or a monthly review is overdue. It does not collect the logs themselves.

Log forwarding: if you configure log forwarding, we send your workspace's own activity stream (sign-ins, documents generated, evidence uploaded, connector syncs, and similar platform events) every few minutes to the destination you specify: a SIEM, an S3 bucket in your own AWS account, or an HTTPS collector. That destination is under your control and outside this policy.

5. Connected AI Assistants (MCP)

CMMC Map offers a connector (using the Model Context Protocol) that lets you link your own AI assistant, such as Claude, to your workspace. Your assistant can read data from your workspace only after you authorize the connection through a secure OAuth sign-in, and only when you direct your assistant to use it. Data retrieved this way goes to your AI assistant and is handled under that assistant provider's own terms and privacy policy, not this one. You can revoke a connected assistant's access at any time, and we may revoke access tokens when needed for security.

6. Consultant and Client Workspaces

Consultants, managed service providers, and other advisors can manage several client organizations from one account. Each client has its own workspace. The consultant's account can view and edit that workspace, including its answers, evidence, and generated documents, and is billed for it. Client contacts the consultant adds may receive questions by email; their replies are recorded in the client's workspace. Documents generated for a client workspace may carry the consultant's name as preparer.

In this arrangement the consultant is responsible for having the client's authorization to hold and work on the client's information in CMMC Map, and for telling the client that CMMC Map is the system used. If you are a client and want a copy of your workspace or want it separated from a consultant's account, contact us and we will work it out with both of you.

7. Personnel Records: People, Training, and Policies

The People features let a workspace keep a roster of its organization's personnel, assign them training and policies, record completions and acknowledgments, and issue certificates. People on the roster do not need a CMMC Map account. You decide who is on it: you type people in, upload a CSV, or import your Microsoft 365 or Google Workspace directory, and you can add or remove anyone at any time.

After a first directory import, the app checks the directory nightly and queues any additions or departures it finds for an owner or admin to approve or reject; nothing changes the roster without that approval. At your direction the app also emails people on the roster, in your organization's name, about training and policies assigned to them, with reminders before and after a due date. Those emails are sent from our sending domain and carry your organization's name.

People complete training and acknowledge policies in a learner portal at app.cmmcmap.com/learn, signing in with a one-time code sent to their email address or with their Microsoft work account. We record what they completed, when, their score where a course is graded, and when they last signed in. When someone acknowledges a policy we also record the network address and browser they used, so the acknowledgment can stand as evidence. Each month we file a "Training and policy records" report into your workspace as evidence, and you can export the records at any time.

If you run the CUI discovery scan (Section 4), the CUI findings register can link each file or mailbox location it found to its owner on your roster, record what was done about it, and, at your direction, email that owner to ask them to move or confirm it.

These are your organization's records about its own personnel. You are responsible for having the authority to keep them in CMMC Map, for telling your personnel that you use it, and for removing people who should no longer receive notices. Records of people who have left are kept as part of your compliance evidence until you delete them. If you are an employee whose records a customer keeps here, direct requests about them to your employer; we will help your employer respond.

8. Data Storage and Security

Your data, including uploaded files, is stored in Supabase (PostgreSQL and object storage), hosted in the United States. We use row-level security so each organization can only access its own data. All data in transit is encrypted with TLS. Connector credentials are encrypted at rest under a key held separately from the database. Multi-factor authentication is available for every account and can be required for every member of a workspace. We follow CMMC-aligned security practices, consistent with what we help our customers achieve.

Staff access: our staff can see workspace data only to provide support you ask for, to investigate abuse or a security incident, or when the law requires it. Every action taken from our administrative console is logged. Replies you send to our automated emails are received and read by our staff.

Important: CMMC Map is not an approved CUI storage system. Do not upload actual Controlled Unclassified Information to the platform.

9. Data Retention and Deletion

We keep your account and workspace data for as long as your account exists, whether or not you have a paid subscription, so that a free account's work is never lost. You can delete individual uploaded files yourself at any time.

When you close your account or ask us to delete it, we delete your workspace data, uploaded files, and activity records, and remove your login, within 30 days of the request, and usually much sooner. We keep billing records for as long as accounting and tax rules require. We keep security records (sign-ins, failed attempts, the network addresses behind them, and browser type) and the website visit records described in Section 1 for up to 12 months, then delete them. The business contact record described in Section 1 is kept until you ask us to delete it.

10. Cookies, Analytics, and Website Visits

Essential cookies: a session cookie that keeps you signed in, a cookie that remembers your appearance setting, and Cloudflare security cookies that protect the site from automated abuse.

Analytics: we use Google Analytics on the public website and inside the application to understand aggregate usage, and Cloudflare Web Analytics on the public website for page performance and visit counts; Cloudflare's measurement sets no cookie. Inside the application, Google Analytics records page views and a small set of sign-up and checkout events with fixed labels: the path with workspace and record identifiers masked and query strings removed, no user identifier, and no workspace content. When a subscription starts we send Google the transaction identifier and amount, with no personal details. Google Signals and ad personalization are turned off, and a random cookie identifier links a visit to the website with a visit to the application so we can see whether a page led to a sign-up. No advertising or cross-site tracking cookies are used. You can block analytics cookies in your browser without affecting the service.

Website visits: each visit to the public website is recorded once per browser session as described in Section 1, without a cookie. Its approximate location comes from Cloudflare, and the network address is sent to IPinfo (Section 11) to find the network's owner and country. We may look up the organization that owns the network behind a visit and research that organization from public sources and commercial business contact databases to decide whether to reach out to it. This identifies an organization, not a person, and it is never linked to an account.

11. Sharing of Information

We share data only with the following service providers who process it on our behalf, and only as needed to run the service:

Microsoft and Google act as sources of your own tenant's data when you use an evidence connector (Section 4), the destination you configure receives your activity stream when you turn on log forwarding (Section 4), and your own AI assistant receives data you direct to it through the MCP connector (Section 5). We may disclose data if required by law, subpoena, or to protect the rights and safety of Hydromation, our users, or the public. If we ever add a service provider that receives personal data, we will update this list before it starts.

12. Your Rights

You can:

To exercise any of these rights, email [email protected]. We respond within 30 days. If a customer keeps records about you as its personnel (Section 7), ask your employer; we will help them respond.

13. Children's Privacy

CMMC Map is intended for business use by adults (18+). We do not knowingly collect personal data from anyone under 18. If we learn that a minor has created an account, we will promptly delete the account and associated data.

14. Changes to This Policy

We may update this Privacy Policy as the service evolves. We will notify registered users of material changes by email at least 14 days before they take effect. The effective date at the top of this page reflects the most recent revision.

September 12, 2026 revision: added the evidence connectors, consultant and client workspaces, Google sign-in, analytics inside the application, phone number at sign-up, and multi-factor authentication; restated retention and deletion as they are actually practiced; consolidated contact addresses to [email protected].

October 17, 2026 revision: named the two IP geolocation services (ipinfo.io and ip-api.com) that receive the network address of each visit to the public website.

November 2, 2026 revision (published October 18, 2026): added Microsoft sign-in; a new Section 7 on personnel records, training, policy acknowledgments, and the learner portal; Microsoft Sentinel, log sources, and log forwarding in Section 4; the current list of AI features in Section 3; website forms, events, and business contact records in Section 1; Cloudflare Web Analytics and the sign-up and checkout events in Section 10; identification of visiting organizations; staff access in Section 8; retention periods restated in Section 9 for security and website visit records; and the phone number removed from sign-up (October 18, 2026).

October 19, 2026 revision (also made to the version in force until November 2): website visit lookups now go to IPinfo alone, for the network's owner and country; approximate location comes from Cloudflare, which already carries the site. ip-api.com no longer receives anything.

15. Contact

Privacy questions or requests:

Hydromation Corporation
12015 US-50 Suite 600
Fairfax, VA 22033
[email protected]