What Bugle holds, and does not
Bugle holds no security certification, and has not been independently audited or penetration-tested. Its own assessment against the SOC 2 criteria, and its written security policies, are available on request, below. Everything on this page is a fact about the service as it is built.
Security
- Each department is sealed from every other by row-level security inside the database, tested by attack before every release.
- Two-step sign-in, single sign-on, and a second check of who you are before every high-risk action.
- Every high-risk action is its own permission; nobody sitting a process sees its questions or judges it.
- A hash-chained audit record, verified every day, and an access record of every reading of examination content, demographics or accommodations, and every export.
The security page has the detail.
Privacy
Bugle holds a department’s information on its behalf; the department decides what is collected and how long it is kept. Candidate information is never sent to an AI provider, and nothing is sold. The privacy notice says what is held and why.
Accessibility
Built to WCAG 2.2 Level AA. Bugle’s own assessment finds 28 of the 55 requirements supported and 21 in part; it has not had an independent audit. The accessibility statement says what is built in and where it falls short.
Data hosting
- Everything is held in the United States: the application on Vercel (Cleveland, Ohio), the database on Neon in Amazon Web Services’ Ohio region, files on Vercel’s private storage.
- Encrypted in transit, with browsers told to refuse an unencrypted connection, and at rest by the database and storage providers.
- The database can be restored to any moment in the last six hours; longer history and an off-site copy are being put in place, and contracts say so.
AI use
Drafting examination questions and scenarios from a department’s own documents is where automated drafting is used. Every drafted question is marked as drafted, and every draft is approved by a person before it can be used. It never decides a score, a key or a list, and never sees candidate information. The AI-use statement sets out exactly where and how.
Examination integrity
- A published form is frozen and hashed; the database refuses any change to it, and its hash is checked when a candidate starts it and when it is scored.
- Blind scoring by code, calibrated panels, proctored sittings recorded step by step, and results checked before release.
- Every certified list carries the hash of what was certified.
Examination integrity, in full, on the security page.
Responsible disclosure
Found a weakness? Write to charles@bugleassessments.com. We reply to every report, and we do not pursue anyone who reports in good faith. The policy is on the security page and in security.txt.
Subprocessors
The companies that process a department’s data for Bugle, as the privacy notice lists them. A department is told before a new one receives its data.
| Service | What it does for us | Where |
|---|---|---|
| Vercel | Runs the application and stores uploaded documents and recordings | United States |
| Neon, on Amazon Web Services | The database | Ohio, United States |
| Resend | Delivers the email the service sends | United States |
| Anthropic | Drafting, filing and suggesting from department documents, finding the rules in an agreement, and helping our staff answer inquiries, as described on the AI use page | United States |
| OpenAI | Generating a simulation’s pictures and voices from its description, where one is generated | United States |
| Render | Runs the nightly backup of the database, which is sealed before it leaves the job so that only we can open it | Ohio, United States |
| Cloudflare | Keeps a second copy of stored documents and recordings, and the sealed database backups; and connects the two ends of a video call, such as a remote check-in, relaying its sound and picture when they cannot reach each other directly. The call stays encrypted between the two browsers, so the relay cannot see or hear it, and keeps nothing of it | North America; a call, through its location nearest each person |
| Google Workspace | Our own email, including notice of contact-form messages | United States |
| Deepgram | Writes down what a candidate says aloud: on a simulation’s radio, as it is sent, so the simulation can answer; and in a recorded spoken answer, for the panel. Every request tells it to keep the recording only as long as it takes and never to learn from it | United States |
| Inworld | Speaks a simulation’s radio traffic — dispatch, the companies, the people on the scene — including replies that repeat a candidate’s order back; writes a recording down when Deepgram cannot. It never trains on audio it writes down; the words it speaks are kept in its logs under its own policy | United States |
Records and portability
A department’s records are its own. Its officials can take a records package at any time — its sources, job analysis, processes, lists and audit record — in documented formats any computer can read, without asking Bugle; the package lists what it leaves out and how each is had, and every contract commits Bugle to a complete export within thirty days of the agreement ending. What the records package holds.
Documents for your review
For a department evaluating Bugle. Ask for them; we send a private link, good for 14 days, and each copy is marked with whom it was prepared for.
- Security questionnaire answers. Ready answers to the questions municipal IT reviewers and cyber insurers ask, each with where its evidence is.
- Architecture overview. How the service is built and hosted: its parts, where each runs, how departments are kept apart.
- Data-flow description. What data enters the service, where it goes, who can see it and what leaves.
- Incident-response summary. How an incident is found, contained and reported, and when a department is told.
- Business-continuity summary. What happens to a sitting, a deadline and a department’s records if a provider, or Bugle, fails.
- Accessibility conformance report. Bugle’s own assessment against WCAG 2.2 A and AA, criterion by criterion, with its plan.
- Government buyer readiness statement. Bugle’s own assessment control family by control family, in the shape a city’s IT office reviews against (NIST SP 800-53; CJIS and state programs read the same way), with every gap named. Not an audit.
- SOC 2 readiness assessment. Bugle’s own assessment against the SOC 2 Trust Services Criteria. Not an audit, and it says so first.
Not available:
- Penetration-test executive summary. No independent penetration test has been performed yet. When one has, its executive summary will be offered here.
- Certificate of cyber-liability insurance. Not yet available. It will be offered here once cover is in force.
- SOC 2 report. Bugle has not been audited and holds no SOC 2 report. Its own readiness assessment, which is not an audit, can be requested above.
Business contact
charles@bugleassessments.com, or tell us about your process. We answer every message.