BEAD Cybersecurity Reviewer Artifact
Security Posture

Cybersecurity & Data Protection Posture

SWWWC cybersecurity and data protection posture for BEAD reviewers and procurement officers — customer data inventory, encryption posture, incident response, key management, sub-processors, and audit trail.

Last reviewed
2026-08-04
Security contact
security@swwwc.net
Back to BEAD Submission Package
Customer Data

What we collect, store, and who can access it

This inventory covers every customer-data table in the AirConnectOS application database. It is the authoritative list for BEAD data-handling review; the retention windows reflect operational need, tax/regulatory obligation, and program enrollment duration.

What is collected
  • Subscriber name, service address, contact phone, and email at signup
  • Plan tier, install date, monthly pricing, and current billing status
  • Network telemetry per tower site (latency, packet loss, capacity — anonymous and aggregated)
  • Outage report submissions (customer-supplied description, optional speed-test samples)
  • Inbound contact form messages from community, press, and partnership inquiries
  • Referral program participation data (referrer code, signup count, $25 credit balance)
  • Coverage-inquiry and waitlist signup data (full name, address, email, phone)
Where it is storedManaged PostgreSQL on Neon (US region). Application layer is the only writer; analytics logs forwarded to Polsia beacon endpoint are hashed/truncated per Polsia analytics contract.
Retention windowSubscriber records: length of service plus 7 years (tax/regulatory). Waitlist and outage reports: 24 months. Referral signups and credit ledger: length of program enrollment plus 3 years. Inbound contact submissions: 24 months. Synthetic uptime probes: rolling 30 days (see /grants uptime headline).
Who has access SWWWC operations staff (the operator) — read/write on operational records | Neal Brown, Founder — administrative and incident-response lead | Polsia platform engineers — infrastructure-level only; no read access to customer rows
Data-table inventory
subscribers Active subscriber roster (plan, status, billing)
referral_users Referral program participants and AIR-XXXXXX codes
referral_signups Referral event ledger (referrer, referee, credit issued, true/false)
waitlist Out-of-coverage address waitlist (full_name, address, email, phone)
contact_submissions Inbound inquiries (community, press, partnerships)
outage_reports Customer-submitted tickets (OTR-XXXXX)
users Polsia-managed subscription billing rows
Encryption

In transit and at rest

SWWWC applies layered encryption for defense-in-depth — TLS at the application edge, provider-managed disk encryption on the database volume, and TLS-protected connections to every sub-processor.

In Transit
TLS versionsTLS 1.2 and TLS 1.3 enforced at the Render edge; no plaintext HTTP listener reachable on www.swwwc.net.
HSTSStrict-Transport-Security enabled with includeSubDomains; preload-eligible.
At Rest
Database volumeNeon managed Postgres — provider-managed disk encryption enabled by default; volume-level AES-256.
BackupsNeon point-in-time recovery retained for 7 days; logical backups retained for 30 days within Neon infrastructure.

Note. Customer PII is not encrypted with an application-managed key envelope today. The protections in scope are TLS in transit and provider-managed disk encryption at rest. If a BEAD award requires application-layer envelope encryption (KMS-managed DEK), this is a 2–4 sprint scope decision documented in our roadmap.

Incident Response

Named contacts, response windows, escalation path

SWWWC operates an in-house 24/7 NOC staffed by named operators. There is no third-party SOC referral in the response path — incidents are detected, triaged, contained, notified, and reviewed internally.

Primary contact
Neal Brown — Founder, SWWWC operations
Backup contact
24/7 SWWWC NOC (in-house) — escalation through on-call rotation
Response windowSeverity 1 (active breach): acknowledged within 1 hour, mitigation in progress within 4 hours, written notification within 24 hours. Severity 2 (containment required): acknowledged within 4 business hours, mitigation within 24 hours. Severity 3 (no immediate impact): triaged within 2 business days.
External reporting cadenceFor confirmed incidents affecting customer data: written notice to impacted data-subjects within 72 hours. Internal post-incident review within 10 business days.
Escalation steps
  1. Detect: monitoring alert fires (uptime probe, application error, or database anomaly)
  2. Triage: on-call engineer classifies severity and assembles the response cell
  3. Contain: isolate affected systems or rotate credentials as warranted by the incident class
  4. Notify: contact SWWWC leadership, then impacted data-subjects per the reporting cadence
  5. Recover: restore service, validate against monitoring, capture timeline in post-incident review
  6. Review: written post-incident summary filed; remediation items added to the operational backlog
Key Management & Access Control

Secrets, credentials, and admin surfaces

All application secrets are managed declaratively through the Polsia secrets plane. There is no key escrow and no customer-managed KMS today — the encryption-at-rest primitive is provider-managed disk encryption on the Postgres volume.

Secrets managementApplication secrets stored as Polsia-managed environment variables (DATABASE_URL, email proxy credentials, admin token, Stripe keys). Database connection string rotated at every deploy window; legacy values are invalidated.
KMSNo customer-managed KMS today. Provider-managed disk encryption on the Postgres volume is the encryption-at-rest primitive. Administrative actions gated by the principle-of-least-privilege model below — not by key escrow.
MFA on admin surfacesMulti-factor authentication required on all admin surfaces (Render console, Neon console, GitHub, domain registrar, email provider admin). Hardware-backed authenticator preferred; TOTP acceptable on management accounts.
Admin access (standing)Only Neal and named SWWWC operators hold admin credentials. No third-party contractor or external agency has standing admin access to the database, the application runtime, or the DNS layer.
Principle of least privilegeThe /admin/leads route is token-gated — read-only over service_inquiries rows, no write capability, scoped to a single table. There is no remote command surface and no database writeable API surface exposed to the public internet.
Sub-Processors

Every third party that touches customer data

Short by design — only sub-processors that actually handle customer data are listed. No marketing-pixel vendor, no third-party web analytics service, no off-platform CRM is in scope.

Name Neon (Databases Inc.) Purpose Managed Postgres hosting for the AirConnectOS application database
Data shared All customer PII rows (subscribers, waitlist, contact_submissions, outage_reports, referral program) Location United States (AWS us-east-2 region)
Name Polsia Purpose Application hosting, render-layer edge, analytics beacon, and outbound email proxy
Data shared HTTPS request metadata, page-view analytics (hashed visitor IDs), and outbound transactional email payload (recipient name + message body for outage notices and contact replies) Location United States (Render-hosted)
Name Polsia Stripe Connect (via the platform HTTP API) Purpose Subscription billing for accounts that opt into recurring billing
Data shared Billed customer email, plan tier, and monthly amount — tokenized through the Polsia Stripe Connect proxy; this app does not hold a Stripe secret key Location United States
Logging & Audit

What is logged, what is retained, and how we monitor

Logging scope is narrow on purpose — request status, route, latency, and error message. PII is not written to log lines. Audit retention is scoped to operational need, with probe rollups tied to the 30-day rolling window referenced on /grants.

Access logsRender access logs retained by the platform on the standard Render retention schedule (currently 30 days). Application code does not log PII beyond the request path; no request body is logged at the application level.
Application logsExpress application logs scope to status code, route, latency, and error message. Customer-identifying values are not written to log lines.
Audit retentionDatabase-level audit (a logical activity timeline maintained by the application) retained for 12 months for subscriber-table changes; 6 months for other tables. Uptime probe rollups referenced at /grants are retained on a 30-day rolling window.
AlertingPolsia platform uptime monitoring + cron-driven synthetic probe writer (see monitoring_probes table). Alerts route to the SWWWC NOC on-call rotation; outage detection latency target is 5 minutes end-to-end.
MonitoringPolsia analytics beacon provides aggregate page-view and referrer information. No third-party web analytics service is in scope (no Google Analytics, no Meta pixel).
Security Contact

Reach the security team

Grant reviewers, procurement officers, and IRT/CIRT partners — reach out directly on security-specific questions. We respond to government and incident-response inquiries within one business day.

security@swwwc.net General inquiry → /contact Live network status