Skip to content

For IT & procurement

Procurement & IT

A single page for reviewers who ask whether SSO, billing, and assurance are done. Built ≠ live. See /security, /facts, and /pricing.

Built and usable

  • RBAC + DocumentACL

    Live in product. Restricted documents omit titles when unauthorized.

  • Audit log export

    Append-only events; authorized roles can export.

  • Full-record export

    The full record of decisions, votes, minutes, actions and document details; uploaded files download separately (JSON / ZIP) — see /leaving-prepared.

  • Records & discovery policy

    Draft retention, legal hold, counsel-direction markings (≠ privilege).

  • AI use policy + per-board AI off

    No foundation-model calls today; gate ready for generative endpoints.

  • Agent connection (MCP + read-only API)

    Off until the chair allows it. OAuth 2.1 sign-in with PKCE and a consent screen (Claude.ai / ChatGPT connectors) or per-director personal access tokens; all tokens stored hashed, scoped, expiring, revocable; same access rules as the app; every call audit-logged. Prepared calls no AI model.

  • PDF upload to packs

    Stored per board with access controls. Strict PDF validation before storage (rejects encrypted PDFs, JavaScript, embedded files, launch/form-submit actions). Not antivirus scanning.

Not live yet

  • SSO (SAML / OIDC)

    Built via WorkOS: Sign in with SSO by email domain, mapped to existing memberships (never grants admin), every login audited. Live once production credentials are connected and the customer IdP is set up. Governance+, setup on request.

  • SCIM directory sync

    Not available yet. Remove members in Prepared Board today; revoking access ends their sessions immediately.

  • Passkeys / WebAuthn

    Not production-live by default.

  • Stripe billing / invoices

    Built: annual / monthly Checkout, customer portal, signature-verified webhooks, plan gating, 30% nonprofit coupon. Live once production credentials are connected; nothing is charged today.

  • Independent security audit or certification

    None yet.

  • Outside pen test

    Planned before paid launch.

  • Production hosting

    Vercel (app hosting, US iad1) + Neon Postgres (database, AWS us-east-2) + Vercel Blob (uploaded files). Provider-managed encryption at rest; TLS in transit.

Security addendum: available on request once a design-partner or paid board is in diligence — we do not invent attestations on this page.