Shared responsibility

Shared Responsibility Statement

Go Fund It Now, LLC · Version 1.0 · Effective November 9, 2026

Prepared for government-contractor customers and their CMMC assessors.

Purpose and scope

This statement describes how security responsibilities are divided between Go Fund It Now, LLC and the customer for the GFIN platform. It is written for government-contractor customers and their CMMC assessors.

It summarizes the Terms & Conditions and the Privacy Policy. It is not a contract, certification, audit report, or legal opinion, and it does not modify those documents. If this statement and the Terms differ, the Terms control.

It covers the GFIN platform, websites, AI-assisted workflows, and related services. It does not cover a customer's own systems, networks, devices, or third-party services the customer chooses independently.

Our position on controlled data

GFIN is not authorized or accredited to receive, store, or process classified information, Controlled Unclassified Information (CUI) as defined in 32 CFR Part 2002, or technical data controlled under the International Traffic in Arms Regulations (ITAR) or Export Administration Regulations (EAR).

Customers must not upload or submit such information. A government contractor should keep controlled information in an environment authorized under its own contracts and use GFIN for non-CUI pursuit work. If GFIN reasonably believes content is controlled, it may remove the content and will notify the customer. This restates Terms section 3; the Terms control if this summary and the agreement differ.

Responsibility matrix

Area	Go Fund It Now	Customer
Data classification and controlled data	Publishes the no-CUI, no-ITAR/EAR, and no-classified-data restriction in the Terms. May remove content reasonably believed to be controlled and will notify the customer.	Classifies its data. Does not upload CUI, ITAR/EAR-controlled technical data, or classified information. Keeps controlled data in its own authorized environment.
Identity and access	Authenticates users, enforces role-based authorization and least-privilege access, and authenticates service-to-service calls.	Manages team membership and roles, protects credentials, removes departed users, and reviews access.
Platform protection and monitoring	Uses TLS in transit, cloud storage access controls, security monitoring, audit logging, and least-privilege operations.	Uses approved devices and networks, protects its own credentials, and reports suspected unauthorized access.
AI processing and outputs	Uses AI providers through API or enterprise channels, disables provider training where supported, and does not use customer proposal content to train foundation or third-party models.	Does not submit controlled or confidential third-party data without authorization, and reviews AI outputs before use.
Data retention, export, and deletion	Retains and deletes data as described in the Privacy Policy and Terms, and makes uploaded data available for export for 30 days after termination.	Exports its data before termination and maintains its own records.
Incident response and notification	Investigates security events and notifies affected customers as described in the Terms and Privacy Policy.	Reports suspected unauthorized access or vulnerabilities promptly and cooperates on the investigation.
Compliance and assessment	Provides the Terms, Privacy Policy, and this statement. Does not claim CMMC certification, FedRAMP authorization, or accreditation as a CUI enclave.	Owns its CMMC assessment and any customer-specific compliance obligations, and keeps controlled data in an authorized environment.

What this statement is not

This statement is not a CMMC certificate, FedRAMP authorization, audit report, or legal opinion. It does not replace a customer's CMMC assessment or its own due diligence. If a procurement requires a specific artifact, contact [email protected] and we will confirm what is available.

Review and contact

Reviewed November 9, 2026. We review this statement at least annually or when the platform changes materially. Questions and vulnerability reports: [email protected]. The disclosure policy is at https://gofunditnow.com/.well-known/security.txt. Do not include customer data or controlled information in a report.