One Protected Home for Your Whole Assessment.
AssessrLog holds your determinations and the evidence behind them, in one place built to protect it. Isolated per company, encrypted, access-controlled, and kept as a tamper-evident record.
Tenant Isolation
Per Company
Encryption
In Transit + At Rest
Access
Authenticated Sessions
Record
Tamper-Evident
Malware Scanning
Every Upload
Authorization
Least Privilege
Your Assessment and Its Evidence, in One Place.
Level 1 asks you to prove what you have put in place. That proof is real evidence, and it should not be scattered across a dozen laptops and shared drives. AssessrLog brings the assessment and the evidence behind it into one protected home, built to protect what you put in it.
Isolated per company. Your assessment is separated from every other tenant.
Encrypted connections, and evidence encrypted at rest, on US-region infrastructure.
Reached only through an authenticated session. There is no anonymous way in.
- CUI and anything above Federal Contract Information.
- Level 2 material and classified data.
- Contract deliverables that are not assessment evidence.
- DET
Your determination for each requirement. Met, Not Met, or N/A.
- BASIS
The plain-English basis behind each decision.
- EVID
The evidence you upload, versioned and content-hashed.
- CONF
The date, and the person who confirmed it.
Sealed in Order. Attributed. Kept for Six Years.
A determination is a decision with weight behind it, so the record treats it that way. Each one is sealed to the one before it, never quietly changed. Every entry carries who made it and when, and the whole assessment record is retained for six years while your subscription is active.
AC.L1-b.1.i
Determined MET
IA.L1-b.1.vi
Determined MET
SC.L1-b.1.x
Evidence Linked
PE.L1-b.1.viii
Basis Recorded
SI.L1-b.1.xiii
Determined MET
Tamper-Evident.
Every determination is sealed to the one before it. A later edit, deletion, or reorder is detectable.
Attributed.
Every entry carries the person who confirmed it and the date it was made.
Retained.
While your subscription is active, the whole assessment record is kept for six years from the assessment date, as the CMMC rule requires.
You Are the One Who Decides. Every Time.
AssessrLog organizes the work, but it does not make your call. Access is protected by authenticated sign-in with multi-factor available on every account, your assessment is isolated from every other company, a person stands behind every determination, and the product never affirms on your behalf.
- Access ChannelID · 0101
Multi-Factor Sign-In
Access is authenticated every session, with time-based multi-factor available on every account.
01 / 04 - Access ChannelID · 0202
Isolated, With Invites You Control
Your assessment is separated from every other company. Bring your team in with single-use, revocable links.
02 / 04 - Access ChannelID · 0303
A Person Records Every Determination
Nothing is recorded until you record it. AssessrLog never invents a status you did not set.
03 / 04 - Access ChannelID · 0404
Your Affirmation Stays Yours
Your senior official signs the annual affirmation in SPRS. AssessrLog never signs it for them.
04 / 04
Basis of Determination · Recorded by You
“Access to company systems is limited to authorized users through named accounts and role-based permissions.”
Your Determination
You record every determination. AssessrLog never invents a status and never affirms for you.
Built for Trust.
Not for Show.
You are trusting this system with your assessment record, so the security posture behind it belongs in writing. Here is how AssessrLog is built. The design commitments the environment is held to on one side, and the operating doctrine that enforces them in production on the other.
The Principles the Assessment Home Is Designed To.
- D/01US-region hosting
- D/02Encrypted connections and encryption at rest
- D/03Tenant isolation between customers
- D/04Multi-factor authentication
- D/05Single-use, revocable invites
- D/06Least-privilege access to internal systems
The Operating Doctrine the Production Environment Runs By.
- OD/01Defense in depth across every tier
- OD/02Network segmentation with an isolated data tier
- OD/03Fail-closed malware scanning on uploads
- OD/04Immutable, scanned production images
- OD/05Human-approved production deployments
- OD/06No standing access to production
We Practice
What We Preach.
The environment that holds your assessment is held to the same baseline you assess. All 15 safeguarding requirements of FAR 52.204-21 are implemented, with 13 verified in AssessrLog's own production environment and the two physical protection requirements inherited from our cloud provider's data centers. A CMMC Level 1 self-assessment, reviewed quarterly and recorded the way we ask you to record yours.
- AC.L1-b.1.iLimit system access to authorized usersMET
- AC.L1-b.1.iiLimit access to permitted functionsMET
- AC.L1-b.1.iiiVerify and control external connectionsMET
- AC.L1-b.1.ivControl publicly posted informationMET
- IA.L1-b.1.vIdentify system users and processesMET
- IA.L1-b.1.viAuthenticate user identitiesMET
- MP.L1-b.1.viiSanitize media holding FCI before reuseMET
- PE.L1-b.1.viiiLimit physical access to systemsINHERITED
- PE.L1-b.1.ixEscort visitors, log physical accessINHERITED
- SC.L1-b.1.xProtect communications at boundariesMET
- SC.L1-b.1.xiSeparate public components from internal networksMET
- SI.L1-b.1.xiiIdentify, report, and correct flawsMET
- SI.L1-b.1.xiiiProtect against malicious codeMET
- SI.L1-b.1.xivKeep malware protection currentMET
- SI.L1-b.1.xvScan files from external sourcesMET
INHERITED marks a requirement our cloud provider satisfies for the data centers that run AssessrLog, documented in our own assessment record.
A Self-Assessment, Claimed as Exactly That.
Level 1 carries no third-party certification, and we claim none. This is our own posture, recorded and kept the same way your assessment is.
Held Voluntarily.
AssessrLog is a product of ProfytAI, and neither holds a DoD contract or files an SPRS entry. We meet the baseline because your evidence lives here, and a vendor should hold itself to the standard it helps you meet.
Due Diligence, Ready.
A flowdown summary for your prime is available on request, with the full System Security Plan shared under NDA.
Built to Earn Your Trust. Then Keep It.
Your assessment and the evidence behind it deserve better than scattered folders and a shared drive. AssessrLog gives them one protected home.