From project intake to final report delivery — one structured platform for security teams that need visibility, automation, and enterprise-grade access control.
Platform Features
Built for security firms — not a generic PM tool bolted onto security workflows.
OAuth 2.0/OIDC authentication with zero friction for Microsoft 365 environments. No extra credential management needed.
Admin, Sales, and Delivery each see a tailored view. Revenue tracking, workload visibility, and status badges — all in one place.
Six assessment types with a 4-stage status workflow. S3 delivery folders auto-created; projects auto-complete when all assessments close.
Quill-based templates with 13 auto-variables and one-click PDF + DOCX export stored securely in S3.
DynamoDB, S3, SSM Parameter Store. Secrets loaded at runtime — never hardcoded. Deployed on ECS Fargate with Docker.
Real-time event alerts on assignments, status changes, and completions — plus three scheduled reminders (weekly, monthly, quarterly) that surface unassigned, stale, and overdue work automatically.
Automate and integrate. A CSRF-protected REST API powers every screen, and a remote Model Context Protocol server lets AI clients like Claude Desktop and Claude Code act on your behalf — authenticated with per-user tokens and bound by the same role-based access (scoped read or read-write).
Paste raw assessment notes — AI identifies and consolidates findings, writes professional security write-ups with full CVSS 3.1 scoring, auto-sorted by severity. Yellow [TO DO:] markers highlight engagement-specific gaps for analyst review before delivery.
Review reports the way you review a shared doc. Highlight the exact text and pin a comment to it (📌 anchored), or leave a 📝 general note. Author and reviewer reply in threads and resolve them, then the reviewer approves or requests changes — all inside the editor, with Slack notifying the reviewer. Review is optional and never blocks delivery.
See how review works →Access Control
A two-layer model: a Role Gate checks if the role is allowed to act (returns 403 if not), then a Filter Level limits which records the user can see. Admins bypass all filters.
* Generate uses assessment-level filtering — user must appear in the
assignment record for the specific assessment (assignedMembers, assignedMember, or createdBy).
All other report actions use project-level filtering (user must be projectLead, salesLead, or in teamMembers).
Under the Hood
Enterprise infrastructure with zero compromise on security or reliability.
Collaborative Review
Review reports like a shared document — pin comments to the exact words they're about, talk it through in threads, and approve or request changes without ever leaving the editor.
Select the exact text and pin a note to it — the comment is tied to the words it's about, and one click jumps straight to the highlight. No more "para 3, second sentence".
Whole-report feedback that isn't tied to a single spot sits alongside the anchored ones, clearly tagged so nothing slips through.
Author and reviewer reply back and forth on each comment, then resolve or withdraw the thread once it's settled. Header counts show what's still open and what's awaiting your reply.
The reviewer signs off or sends it back, with status badges — Pending review, Changes requested, Approved — and a flag if an approved report is edited again. Slack notifies the reviewer on submit. Review is optional; it never blocks delivery.
Programmatic Access
Bring SecurePM into your own tooling and AI assistants. A REST API backs every screen, and a remote MCP server lets AI clients act on your behalf — always within your role's permissions.
Connect Claude Desktop, Claude Code, or any MCP client over Streamable HTTP at
POST /mcp. The client authenticates with a per-user Bearer token and acts as
that user — no shared service account.
Generate read or read-write tokens from your Profile. Tokens are
SHA-256 hashed at rest, shown once, and revocable. Every call re-checks the live user, so the
same access rules as the web app apply — Delivery never sees revenue, and writes require
assignment membership.
Five read tools and two write tools mirror the platform's core operations:
Every view is powered by CSRF-protected JSON endpoints under /api/* — dashboard
stats, project & assessment management, report generation, and admin — secured by
Microsoft Entra ID sessions.
Scheduled Notifications
Three scheduled reminders that surface stale work automatically — no manual chasing required. Silent when everything is on track; fires only when something needs attention.
Projects where no delivery team has been allocated. Fires when hasAssigned=false and age exceeds REMINDER_UNASSIGNED_DAYS (default 7 days). Sorted oldest-first with client name and age.
Individual assessments stuck in ongoing or finding-report-released with no status change. Fires after REMINDER_STALE_DAYS (default 30 days). Uses statusUpdatedAt field; falls back to project creation date for legacy records.
Assigned but incomplete projects past the quarter mark. Fires after REMINDER_UNCOMPLETED_DAYS (default 90 days), showing completion ratio completedCount/totalCount for each project.
ongoing (38d)One platform. Total visibility. From first brief to final report.
← Back to All Projects