Skip to content
Context GRC

Legal

Privacy Policy

Last updated 12 November 2026.

Who we are

Context GRC is a product of GoEvolve LLC, doing business as GoEvolve Assurance, based in Washington State.

This policy covers this website only. It does not cover the Context GRC software itself. That runs inside your own network on your own hardware, and what happens to data there is governed by your agreement with us, not by this page.

What we collect

You can read every page of this site without telling us anything. We only collect information when you choose to submit the request form.

What you type into the form:

  • Your name
  • Your corporate email address
  • Your phone number, only if you choose to give one
  • Your utility or organization name
  • Your governance type and your size and customer reach, chosen from a list
  • Up to three regulatory drivers, chosen from a list
  • Anything you write in the free-text box about where compliance work slows you down

What our server records when you submit it:

  • The IP address the submission came from
  • The date and time, in UTC
  • Whether your email address uses a personal provider such as Gmail or Outlook, which we note only so we know how to reply

We do not use cookies. We do not use analytics, advertising pixels, or any other tracking. The site loads no scripts, fonts, or images from anyone else's servers, so no third party sees your visit. The only thing stored in your browser is your light or dark theme choice, which stays on your device and is never sent to us.

How we use it, and how we contact you back

We use what you send for one purpose: to reply to your request and talk with you about a Context GRC pilot.

That contact may be:

  • An email reply
  • A phone call, only if you gave us a number
  • A scheduled phone or video briefing, if you want one
  • Follow-up messages in that same conversation

We do not add you to a mailing list. We do not send you marketing unrelated to your request. We do not sell, rent, or share your details with anyone for advertising, and we do not use them to train any AI model.

If you would rather we stopped contacting you, reply to any message or write to us and we will stop.

Please do not send us sensitive detail

The free-text box is for a short, general description of where your compliance work slows down. Please keep it at that level.

Do not send us confidential operational detail, network or security configurations, audit findings, vulnerability information, or anything else your organization treats as sensitive. A marketing form is not a secure channel, and we do not need that detail to have a first conversation.

Who else handles it

Two companies handle this information on our behalf:

  • DreamHost hosts this website. Their servers keep standard web logs, which include IP addresses.
  • Runbox delivers the notification email that your submission creates. Runbox is based in Norway, so that email travels through and is stored on servers in Norway.

No one else receives what you send us.

How long we keep it

  • Your inquiry and our correspondence: 24 months after we last hear from you, then deleted.
  • Spam protection: when you submit the form we store a one-way hash of your IP address for about five minutes, to stop repeated automated submissions. It cannot be turned back into your address, and it is discarded after that.
  • Web server logs: kept by our host on their own schedule, which we do not control.

If you ask us to delete your details sooner, we will.

How we protect it

The site is served over HTTPS only, with strict transport security and a policy that blocks scripts from anyone else. Nothing you submit is stored in a database on this website; it goes straight to email. The credentials used to send that email are kept outside the website's public directory.

No transmission over the internet is completely secure, and we will not pretend otherwise.

Your choices

We offer the same choices to everyone who contacts us, wherever you live. You can ask us to:

  • Tell you what we hold about you
  • Correct anything that is wrong
  • Delete it
  • Stop contacting you

Write to info@goevolve.com or call (253) 322-0800. We will respond within 30 days. If a request concerns someone else's details, we may need to confirm who you are first.

Children

This site is aimed at people working in utilities and other organizations. It is not directed to children, and we do not knowingly collect information from them.

Changes to this policy

If we change this policy we will update the date at the top of this page, and if the change is significant we will say what changed.

Contact us

Questions about this policy, or about anything we hold: info@goevolve.com or (253) 322-0800.

GoEvolve LLC, Washington State.

Trust & Security

Built to be inspected

Designed to support your programs. It does not confer certification.

  • Air-gap ready

    Containerized on-prem or private cloud. Every front-end library is vendored locally with documented licenses and SHA-256 manifests, so there are no runtime CDNs.

  • Credentials & MFA

    PBKDF2-HMAC-SHA256 at 600,000 iterations, a NIST SP 800-63B passphrase policy, and TOTP multi-factor authentication.

  • Secrets

    Integration credentials are Fernet-encrypted with a rotation script. Secrets are injected through Docker secrets.

  • Transport & ledger

    TLS between services and a hash-chained, tamper-evident audit ledger of recorded actions.

  • Worker isolation

    Ed25519-signed task envelopes, a least-privilege worker database role under row-level security, pre-persistence DLP screening, and fenced untrusted document text in prompts.

  • Access control

    Role-based access with per-context role grants, and context-scoped views and roles.

  • Supply chain

    177 exact-pinned packages with about 3,000 SHA-256 hashes. CI gates: Bandit, TruffleHog, pip-audit --strict, a copyleft license gate, and Trivy.

  • Attributable approvals

    AI-proposed controls, mappings, and actions are staged for a named, authenticated reviewer to approve across four triage touchpoints, with the decision recorded. Cmd+K opens the command palette.

Licensing

  • Licenses are Ed25519-signed tokens verified locally, with no phone-home.
  • Tiers are set by the number of contexts and internal users.
  • Free Auditor: auditor accounts never consume a seat.
  • After a 14-day grace period the platform moves to a read-only archive. It never locks you out of your records.