Privacy

CMMC Toolbox stores the email address on your account, your company name if you give one, and the assessment answers you enter. No payment details and no uploaded files.

Your documents never leave your environment. Evidence here is a name and nothing more — you record that “Access Control Policy.pdf” exists and which objectives it covers. There is no upload, so there is no copy of your security documentation on our servers to lose.

No tracking. There is no analytics, advertising, or third-party tracking on this site.

Email updates. Your email address and company name are added to our mailing list, which runs on Kit (ConvertKit), along with summary figures about your progress — your score, how many objectives you have answered, how many gaps remain and which domain is weakest — so the emails we send are about your actual situation. Your findings, notes, implementation statements and evidence names are never sent there. Every email has an unsubscribe link, and unsubscribing has no effect on your assessment or your access to this tool.

Day 0 to day 60: active. Full access. You can answer, change answers, add evidence names, and download your report.

Day 60: read-only. The free window closes and the assessment freezes. Nothing is deleted. Your score, your findings, your notes, your evidence names and your report all stay exactly where they are — you simply cannot change them or start a new assessment. We email you before this happens, twice.

Day 365: deleted. A year after you signed up, the assessment and everything in it is deleted for real. We email you 15 days beforehand so the date is never a surprise, and again once it is done. Your email address stays on the mailing list until you unsubscribe.

If you upgrade to dibfi, your answers move with you and are kept as part of your dibfi account under that product’s terms instead. This account’s copy still follows the schedule above.

You do not have to wait for the schedule. Email us from the address on your account, or use the dibfi contact form, and ask us to delete it. We will remove your assessment and confirm when it is gone. You can also ask for a copy of everything we hold on your account, or ask us to correct it.

Your answers are private to your account. We do not share assessment content with the Department of Defense, any assessor, any prime contractor, or any other third party.