Trust and security

Data and Privacy Policy

This policy explains how My Post Command keeps veteran organization records, who can see them, and what officers should and should not store. Last updated November 6, 2026.

Hosted on SOC 2 Type II certified infrastructure Hosted on ISO 27001 certified infrastructure

1. Who owns the records

  • Each post owns its own records. My Post Command holds them on the post’s behalf and does not sell, share, or use them for any other purpose.
  • A post’s Admins can download a full export of the post’s records at any time from Settings.
  • My Post Command does not use post data to train AI models.

2. Where the records are kept

  • My Post Command is hosted on Base44, with all servers located in the United States.
  • The hosting infrastructure holds SOC 2 Type II and ISO 27001 certifications, both confirmed by independent audit. Base44 makes its SOC 2 report available under a non-disclosure agreement through its Security Trust Center.
  • Records are stored on the platform, not on the computers or phones used to sign in.

3. Separation between posts

  • My Post Command serves many posts. Each post’s records are locked to that post, and no post can see another post’s data.
  • Within a post, access is role based. Member records are visible only to officer-level roles. Executive session records are hidden from general members.
  • Platform staff access a post’s data only to provide support the post has requested, or when required by law.

4. Individual accounts and accountability

  • Every user signs in with their own account. Shared logins and shared passwords are not permitted.
  • Changes to post records are logged with the account of the person who made them, so a post knows who created, changed, or deleted a record.
  • When an officer leaves office, the post’s Admin removes or changes their access.

5. Using personal devices

  • Officers may sign in from a personal computer or phone through a web browser. Using a device to access the application is different from storing records on that device.
  • Officers should not download, print, or save rosters, notes, or member records to personal devices, personal email, or personal cloud storage, except for an approved post task, and should delete those copies when the task is done.
  • Devices used to sign in should have a screen lock, and users should sign out on shared or public computers.

6. Member notes and welfare information

  • Member notes should hold only what the post needs: contact attempts and outcomes, dues and membership status, requests for post help and who handled them, and event or volunteer participation.
  • Member notes should not hold medical conditions or diagnoses, mental health information, financial details or amounts, family matters, or personal opinions about a member.
  • Sickness, bereavement, and assistance cases belong in the Welfare section, which is limited to officers, and should record only the type of case and the action taken.
  • If a member is in crisis, officers refer them to the post Service Officer or the Veterans Crisis Line (dial 988, then press 1) and record only that a referral was made.
  • Each post should review its notes at least once a year and remove outdated entries, and purge closed welfare cases on a set schedule.

7. If a post stops using My Post Command

  • If a post stops using My Post Command for any reason, including nonpayment, its records are not deleted right away. The post keeps read-only access for at least 90 days.
  • During that time, the post can export all of its records.
  • After that period, the post’s records are permanently deleted at the post’s request or on notice to the post.

8. Requests for records

  • Because records are kept on the platform, a request for a post’s records can be answered from the post’s account rather than from officers’ personal devices.
  • My Post Command notifies the post’s Admins of any legal request for its records unless the law prohibits it.
  • Within a post, outside requests for records should be referred to the Commander and the Judge Advocate before anything is released.

9. Each post’s own policy

  • Posts are encouraged to adopt their own written policy covering who must use the system, what goes in member notes, and whether the post provides a device to officers who keep its records.

Questions about this policy can be sent to support@midpointcybersolutions.com.

Back to home