Security

Effective date: October 7, 2026

This page describes how in8development, Inc. (“in8development,” “we,” “us”) protects information on in8development.com (the “Site”) and information customers send to us. It also describes security features in CITE that you control. It is a public summary of our practices. It is not a certification, audit report, or contract. A signed order, engagement agreement, or security addendum controls if it conflicts with this page.

1. Scope and shared responsibility

Security is shared.

• We protect the Site, our business systems, and personal information and files that customers send to us for inquiries, billing, support, and signed engagements.
• You protect the systems where CITE is installed, the accounts and permissions you assign, the source material you import, backups of your workspace, and any AI tool or other service you choose to connect.

CITE is installed software. In ordinary use, source files, reports, document hashes, permissions, and the in-application audit history stay in the workspace on systems you or your organization control. We do not receive that content unless you send it to us, you use a feature that expressly transmits it, or a written agreement says we host a workspace.

2. Security features in CITE

CITE includes controls your organization can use to preserve the integrity of a report file:

• Permissions, so access inside the workspace can be limited to the people you authorize;
• Hash values for imported documents, so you can check whether a source file still matches the file that was imported; and
• An action history, so user actions in the workspace can be reviewed.

These features support your own review. They do not, by themselves, make a report admissible, complete, or compliant with a particular legal, regulatory, or agency standard. You are responsible for how the workspace is configured and for checking the record before you rely on it.

3. How we protect information we hold

For the Site and for information customers send to us, we use measures appropriate to the sensitivity of that information. Those measures include:

• Access control. Access to business systems and to customer files sent to us is limited to people who need it to do their job, and access is removed when that need ends.
• Confidentiality. People who work with customer information are expected to protect it and to use it only for the purpose it was provided.
• Transport encryption. The public Site is served over HTTPS, so browser traffic is encrypted in transit.
• Separation of uses. We do not use customer source material or reports for advertising, and we do not use Customer Content to train generalized artificial-intelligence models.
• Least disclosure. Support staff access files you send only to handle the request you made.

You are responsible for backing up CITE workspaces on your systems. We maintain the business records and Site operations we need to run the company. Those backups are not a backup of your local CITE library.

4. Vendors

We use service providers for website hosting (WP Engine), email, payments, CITE license management (Cryptolens), customer-relationship tools (including HubSpot), and site analytics. Google Tag Manager may load analytics tags on the Site. Payment-card details, if you pay online, are collected by the payment processor. We do not store full payment-card numbers on our systems.

We expect vendors that handle personal information for us to protect it and to use it only to provide the service we hired them for. We can provide a current list of those vendors on request to contact@in8development.com.

5. AI tools

If you connect an AI tool inside CITE, you choose the provider and you choose what is sent. That transmission is between you and the provider under that provider’s terms. Do not connect a tool, or send source material, unless that provider’s security and retention practices meet your obligations. CITE does not require an AI connection.

6. Investigative engagements

Matter information should not be sent until an engagement agreement is signed. After it is signed, we use matter information only to perform the engagement, limit access to the people doing the work, and handle it under the confidentiality terms of that agreement. Sending files by email or through the public contact form is not a secure method for sensitive evidence. We will agree on a transfer method in the engagement.

7. Reporting a vulnerability

If you believe you have found a security weakness in the Site or in CITE, email contact@in8development.com with the subject “Security.” Please include a description, the steps to reproduce the issue, and your contact information.

Give us a reasonable time to investigate and respond before any public disclosure. Do not access data that is not yours, do not disrupt the Site, and do not use social engineering against our staff or customers. A good-faith report that follows this process will not be the basis for a legal claim by us. We do not currently operate a paid bug-bounty program.

8. Incidents

If we confirm a security incident affecting personal information we hold, or files you have sent us, we will notify affected customers without undue delay, and we will notify individuals and regulators when the law or a contract requires it. The notice will describe what happened, the kind of information involved, and the steps we are taking, to the extent we know those facts and disclosure will not increase risk.

If you suspect unauthorized access to your CITE workspace or to an account you hold with us, email cite@in8development.com promptly.

9. What this page does not claim

Publishing this page is not a representation that in8development or CITE holds a particular attestation. Unless we have given you a current letter or a signed addendum that says so, we do not represent that we are certified or authorized under SOC 2, ISO/IEC 27001, PCI DSS, HIPAA, CJIS, FedRAMP, or StateRAMP.

Customers who need a security questionnaire, a data processing addendum, or a contractual security schedule can request one at contact@in8development.com. We will say plainly when a requested control is in place and when it is not.

10. Contact

in8development, Inc.
Newman Lake, Washington, United States
Security reports and security questions: contact@in8development.com
+1 (503) 878-7923

Related pages: Privacy Policy · Terms of Service