Security
Plain answers about where your data goes.
What we do, what we keep, and what stays with you.
Your site
Your own dedicated environment.
Kept apart
Every CMMC.Live site runs in its own dedicated hosting environment, with its own files, database, system account, resource limits and backups. Your data is not mixed into one shared database.
Two-step sign-in
Two-step sign-in (MFA), set to match your company’s policy. Choose an emailed code, an authenticator app or a passkey. Repeated wrong passwords lock the address out.
Who sees what
Every page needs a sign-in. A CMMC User sees only the work given to them. An IT company’s customers see only their own company.
The server
Hosted on Amazon Web Services in the United States, on a supported operating system kept up to date. Every site is backed up each day, uses an encrypted connection, and sits behind a web firewall.
Your data
What we keep, and what we never keep.
We keep your answers, notes, policy drafts and the record behind your reports. We keep where your proof is stored, never the proof itself.
CMMC.Live does not store CUI. Never type CUI, passwords or system details into it.
The AI helper
How a question travels.
Your site takes names out, then your question goes through CMMC.Live to our AI service, which writes the answer. Passwords, ID numbers and CUI markings are stopped before they leave your site. Where your proof is kept is never sent.
The AI service may keep what it receives for up to 30 days for abuse checks. That connection is not FedRAMP Moderate, so CUI must never go in.
Who does what
What we do, and what you do.
CMMC.Live does
- Hosts your site in its own dedicated environment
- Keeps the server, software and site up to date
- Backs up your site each day
- Runs the web firewall and sign-in protection
- Swaps out names and stops sensitive text before the AI sees it
- Answers your questions about CMMC and CMMC.Live
You do
- Keep CUI and evidence in your own approved storage
- Decide who gets an account and what work each person is given
- Keep your own computers, network and cloud services secure
- Answer honestly, and check what the AI drafts
- Put your results into SPRS, and have your affirming official confirm them
- Report any cyber incident as your contract requires
Your assessment
Where CMMC.Live fits in your scope.
CMMC.Live does not hold CUI. Your answers and notes do describe your security, so an assessor may treat CMMC.Live as an outside service in your scope. Ask your CMMC professional how to list it.
We are not a C3PAO or a certified assessor. CMMC.Live is not a certification, and we never promise one.
Bring your security questions to the demo.
A short video call with a sample company. We answer what you need to know. No cost, no obligation.