All data is encrypted at rest and in transit based on National Institute of Standards and Technology (NIST) encryption guidelines. CPOMS data stores use AES 256 encryption, and all communications between services and customers are secured with TLS encryption. The product environment is segregated from the outside world using a Web Application Firewall (WAF), with development and staging environments always kept separate from production.

We collect limited data and use it only for the specific reason it was provided, and customer data can be deleted upon request. CPOMS complies with relevant privacy laws such as COPPA and FERPA. The CPOMS Privacy Policy is available for further detail.

CPOMS employs a comprehensive suite of tools, policies, and procedures to ensure the reliability, performance, and security of the CPOMS Platform. This includes active 24×7 availability and performance monitoring, along with active 24×7 security monitoring and alerting through a Managed Security Services Provider (MSSP) to detect and respond to malicious or anomalous activity. We conduct regular vulnerability scans and penetration tests, and system access is limited to a need-to-know basis with permission levels reviewed regularly. Should an incident occur, CPOMS maintains a comprehensive Incident Response policy, including escalation procedures and communication with impacted stakeholders.

All CPOMS employees undergo mandatory security awareness training upon hire, with additional refresher training annually covering password management, phishing detection, and proper handling of sensitive information; developers also receive specialized training on secure coding and Azure infrastructure security. At CPOMS, we recognize the impact data security has on the communities we serve, and we're committed to transparency in sharing updates about the improvements we make to securing our systems and data.