Compliance & Security

Updated October 1, 2026. This page describes the boundaries and implemented features of the public Streamwalkers website and Government Contracting Playbook. It is not an audit report or a certification.

A public learning platform

The Playbook is designed for education, public-source research and preliminary business planning. It is not a confidential client portal, government submission system or document vault. There is no public Playbook account, payment checkout or document-upload facility. Guided setup, explorer, quiz and Go / No-Go answers are processed in the current browser page; downloaded reports are the user’s responsibility.

Do not enter or send classified information, Controlled Unclassified Information (CUI), export-controlled technical data, credentials, medical records, banking details or nonpublic procurement-sensitive material through this platform. A separate approved environment and agreement would be needed before handling protected customer or government records.

Implemented protections and their limits

The public pages are served over HTTPS. The HUBZone adapter sends explicit search requests to a fixed SBA HTTPS endpoint, verifies TLS certificates, restricts request fields and sizes, limits upstream response sizes and timeouts, and returns lookup responses with a no-store instruction. It does not execute JavaScript returned by the upstream map or maintain an address/results database.

The Playbook sets response headers intended to reduce content-type confusion and limit cross-site referrer detail. These measures reduce particular risks; they are not a guarantee of complete protection. Hosting infrastructure still processes technical requests and may keep logs. Browser extensions, shared devices, email and downloaded files have separate risks. See the Privacy Policy for the data flow.

Certification and regulatory status

This public platform does not claim SOC 2 attestation, ISO 27001 or ISO 42001 certification, FedRAMP authorization, CMMC certification, or verified compliance with a particular NIST control baseline. A provider’s credentials do not automatically certify this website or a customer’s business. We do not claim that publishing these policies establishes blanket GDPR, CCPA, PCI DSS or other legal compliance.

Government contract requirements depend on the solicitation, work, information involved and contract clauses. Using the Playbook does not satisfy cybersecurity clauses, reporting duties, personnel requirements, accessibility obligations or certification requirements imposed on your business. Evaluate them independently before bidding or handling contract data.

Reporting a security concern

Email security@streamwalkerscorp.com with the affected public URL, a brief description, approximate time and safe steps to reproduce. Do not include passwords, access tokens, personal records or confidential government information. A sanitized screenshot can help.

Please avoid accessing other people’s information, disrupting service, changing data or publishing exploitable details while reporting a concern. This contact is not permission for intrusive testing, a bug-bounty offer or a guarantee of a response time. If a report requires sensitive evidence, request an appropriate transfer method before sending it.

Ongoing review and reference material

Features, providers and threats change. Material changes to the described practices should be reflected in this page and the privacy notice. The site does not promise that every vulnerability has been identified or that uninterrupted service is available.

Useful primary references include the FTC’s business privacy and security guidance, SBA’s contracting guide and the official HUBZone map. Their inclusion is informational, not an endorsement or certification of this site.