Privacy Policy

Last updated: 8 November 2026

CMMCheck is operated by CMMC Zone, LLC. This policy explains what we collect, why, and what you can do about it. If anything here is unclear, email contact@cmmcheck.com and we will answer in plain English.

What we collect

Account information. Your name, email address, phone number, and company name.

Login codes. CMMCheck does not use passwords. When you sign in, we generate a single-use PIN and email it to you. We do not store passwords or password hashes of any kind, so there is nothing of that sort to lose in a breach.

Assessment content. The answers you give to CMMC Level 1 questions, your notes, and the summary reports generated from them.

Payment information. Handled entirely by Stripe. We receive confirmation that a payment succeeded and the last four digits of the card. We never see or store full card numbers.

Usage data. Standard web analytics through Google Analytics — pages visited, approximate location, browser and device type. This is aggregate and not used to identify individuals.

What we do not collect

We do not ask for and do not want Controlled Unclassified Information (CUI). CMMCheck is a Level 1 tool and is not built or authorized to store CUI. Please do not enter it.

How we use it

To run the Service, generate your assessment summary, process your subscription, send account and renewal emails, respond to support requests, and understand which parts of the site people find useful.

We do not sell your information. We do not share it with advertisers. We do not use your assessment content for any purpose other than providing the Service to you.

Who we share it with

We use a small number of established third-party service providers to run CMMCheck — for application and website hosting, payment processing, transactional email, and website analytics. They may process your information only as needed to provide those services to us, and are not permitted to use it for their own purposes.

We may also disclose information if required by law, or to protect our rights or the safety of others.

How long we keep it

We keep your account and assessment data for as long as your account is active, and for 12 months after cancellation so you can return without losing your work. After that it is deleted. You can ask us to delete it sooner.

Note that CMMC requires you to retain records supporting your self-assessment for six years. Export and store your own copy; do not rely on us as your record of compliance.

Your choices

You can export your data at any time from within the application. You can ask us to correct or delete your information by emailing contact@cmmcheck.com, and we will respond within 30 days. You can opt out of non-essential email while keeping account and billing notices.

Security

Data is encrypted in transit and at rest by our hosting providers. Access is limited to what is needed to operate and support the Service. No system is perfectly secure, and we will notify affected users promptly if a breach affects their information.

Children

CMMCheck is a business tool and is not directed at anyone under 18.

Changes

If we make a material change to this policy, we will email account holders before it takes effect.

Contact

CMMC Zone, LLC · contact@cmmcheck.com