From project intake to final report delivery — one structured platform for security teams that need visibility, automation, and enterprise-grade access control.
Platform Features
Built for security firms — not a generic PM tool bolted onto security workflows.
OAuth 2.0/OIDC authentication with zero friction for Microsoft 365 environments. No extra credential management needed.
Admin, Sales, and Delivery each see a tailored view. Revenue tracking, workload visibility, and status badges — all in one place.
Six assessment types with a 4-stage status workflow. S3 delivery folders auto-created; projects auto-complete when all assessments close.
Quill-based templates with 13 auto-variables and one-click PDF + DOCX export stored securely in S3.
DynamoDB, S3, SSM Parameter Store. Secrets loaded at runtime — never hardcoded. Deployed on ECS Fargate with Docker.
Real-time event alerts on assignments, status changes, and completions — plus three scheduled reminders (weekly, monthly, quarterly) that surface unassigned, stale, and overdue work automatically.
Paste raw assessment notes — AI identifies and consolidates findings, writes professional security write-ups with full CVSS 3.1 scoring, auto-sorted by severity. Yellow [TO DO:] markers highlight engagement-specific gaps for analyst review before delivery.
Access Control
A two-layer model: a Role Gate checks if the role is allowed to act (returns 403 if not), then a Filter Level limits which records the user can see. Admins bypass all filters.
* Generate uses assessment-level filtering — user must appear in the
assignment record for the specific assessment (assignedMembers, assignedMember, or createdBy).
All other report actions use project-level filtering (user must be projectLead, salesLead, or in teamMembers).
Under the Hood
Enterprise infrastructure with zero compromise on security or reliability.
Scheduled Notifications
Three scheduled reminders that surface stale work automatically — no manual chasing required. Silent when everything is on track; fires only when something needs attention.
Projects where no delivery team has been allocated. Fires when hasAssigned=false and age exceeds REMINDER_UNASSIGNED_DAYS (default 7 days). Sorted oldest-first with client name and age.
Individual assessments stuck in ongoing or finding-report-released with no status change. Fires after REMINDER_STALE_DAYS (default 30 days). Uses statusUpdatedAt field; falls back to project creation date for legacy records.
Assigned but incomplete projects past the quarter mark. Fires after REMINDER_UNCOMPLETED_DAYS (default 90 days), showing completion ratio completedCount/totalCount for each project.
ongoing (38d)One platform. Total visibility. From first brief to final report.
← Back to All Projects