01
Controlled access
Every account is gated by verified sign-in — email magic link and, where offered, Google. Access to company information is limited to the authorized account holder and approved Goodstand personnel.
SECURITY AT GOODSTAND
Company data deservesserious protection.
Goodstand is designed to protect the company records, documents, correspondence, and compliance information entrusted to our platform.
LAST UPDATED SEPTEMBER 18, 2026
PRINCIPLES
Protection throughout the company lifecycle.
Security is built into how Goodstand handles company records, documents, and account access from day one.
02
Data minimization
We collect only what is needed to deliver checks, monitoring, documents, filings, and related services. We do not sell personal data and do not use customer documents to train our own models.
03
Secure document handling
Uploaded files and official correspondence are stored privately, transmitted over encrypted connections, and released only to authorized users. You can remove your own uploads and request account closure when you no longer need the service.
04
AI with defined boundaries
AI features are assistive tools with clear limits. They help interpret information you already hold in Goodstand; they do not replace professional judgment and are not legal or tax advice.
05
Customer control
You can review account details, download documents you have access to, and request deletion or correction of personal data. Privacy requests are handled as described in our Privacy Policy and GDPR notice.
INFORMATION
What Goodstand protects.
Goodstand holds a mix of information you provide, information created while you use the product, and public registry records associated with a company you check or monitor. Public registry data is already published by a state or similar authority. Uploaded files, questionnaire answers, inbox mail, and account credentials are treated as customer information.
Customer information
Account and authentication information
Email address, name, sign-in credentials, and session information used to verify who is accessing the account.
Customer information
Company and ownership information you supply
Legal names, jurisdiction, identifiers, addresses, registered-agent details, and other profile fields you enter or confirm.
Customer information
Uploaded company documents
PDFs and images you add to the document vault or a filing workflow, such as formation papers, receipts, or identity documents.
Customer information
Compliance questionnaire responses
Answers you provide during a Check or later review, used to complete an action plan and related workflows.
Customer information
Filing preparation information
Intake details, confirmations, and supporting files collected when you request a filing or catalog service.
Customer information
Official correspondence, where enabled
On Monitor and Managed, inbound mail and attachments forwarded to a company inbox address, including registered-agent correspondence when that channel is set up.
Customer information
AI questions and generated answers
Chat messages, retrieved company context, and assistant replies stored against your account so a thread can continue.
Public source
Public registry information
Status, filing history, and other records retrieved from public sources for a company you search or monitor. This information is public at the source; we store a copy so we can show results, track changes, and generate deadlines.
DATA FLOW
How data moves through Goodstand.
Your information stays within controlled paths — from you, through Goodstand, to authorized partners, and back to you.
01
Customer
You provide company information, upload documents, answer compliance questions, or enable correspondence capture where your plan includes it.
02
Goodstand platform
Information is processed inside Goodstand’s protected environment, separated by account, and handled only for the services you use.
03
Authorized partners
Trusted partners support specific functions such as email delivery, registry lookups, and AI assistance. A payment processor is used only when a paid checkout is active. They receive only what is required for that function.
04
Customer result
Results return to you through encrypted connections as reports, dashboard updates, document access, alerts, or AI replies.
AI
Your data and AI.
Some Goodstand features use trusted AI providers to help answer questions, summarize information, and classify documents or correspondence. Only the information needed for that feature is sent for processing.
Goodstand does not use customer documents, prompts, or outputs to train its own models. AI output is assistive, may be incomplete, and should be reviewed before you rely on it for filing or compliance decisions.
AI does not replace legal, tax, or accounting advice and does not create a professional-client relationship. Final responsibility for filings and compliance decisions remains with you and your advisors.
CONTROLS
Operational safeguards.
Layered protections designed to keep accounts, documents, and correspondence under strict control.
Identity verification
Account access requires verified sign-in to reduce unauthorized access.
Strict account separation
Company records, documents, and correspondence are isolated to the authorized account. One customer cannot access another customer’s workspace.
Encrypted transport and storage
Sensitive information is protected in transit and at rest using industry-standard encryption practices.
Private document handling
Uploaded files and captured correspondence are stored privately and released only through authorized access paths.
Restricted internal access
Goodstand personnel access customer information only when required to operate the service, provide support, or fulfill a filing request.
Session protection
Sessions are protected with secure cookies and modern browser security controls designed to reduce session hijacking and unauthorized reuse.
Abuse prevention
Sign-in, uploads, and high-risk actions are monitored and rate-limited to reduce automated abuse and credential attacks.
Privacy-respecting analytics
Product analytics include first-party usage events that continue even if you choose Essential only. Optional Google Analytics runs only after you accept cookies. We do not use third-party advertising trackers on the platform.
Deletion and retention
You can request account deletion and exercise privacy rights described in our legal policies. Some records may be retained where law or billing requires it.
STANDARDS
Our commitment to security standards.
We treat security as a core obligation, not a marketing checkbox. Controls are reviewed regularly and strengthened as the product and threat landscape evolve.
We do not display certifications, audit badges, or trust-center claims we have not earned. Privacy laws such as GDPR still govern how we handle personal data.
CONTACT
Report a security concern.
If you believe you have found a vulnerability, a privacy issue, or accidental exposure of company data, contact us with enough detail to investigate. Do not access or share other customers’ information.
Reports are handled through our support channel. We take credible security reports seriously and respond as quickly as the issue warrants.
FAQ
Common questions.
RELATED POLICIES