The reason you can trust what you read on ArmorList.
ArmorList is the directory for the body armor market: companies, products and materials, counting published records only. This center documents exactly how that data is sourced and corroborated, how the platform is secured, how buyer and supplier data is protected, and which frameworks we map to, what is met today and what is on a dated roadmap. No hand-waving.
Posture as of this release. Certifications requiring third-party attestation are marked In progress or Roadmap below and are never represented as complete. Documentation available under NDA during procurement.
Where we stand, framework by framework.
Four honest states. Met means built and enforced today. In progress means the control exists but a third-party attestation is underway. Roadmap means committed with a target. Shared means the platform provides the control and the customer operates it, the standard cloud responsibility model.
14 official sources are read on a schedule today, and each company record shows how many of them confirmed it, and when. Some sources are still being connected, and each row below says which. See Data verification below.
IntelAlytic holds no SOC 2 report of its own. Our hosting and payment providers (Supabase, AWS, Stripe, Cloudflare) hold theirs.
The control basis our security program is built toward. No mapping is published and no authorization is held.
TLS 1.2+ in transit, and AES-256 at rest applied by our hosting provider, which manages the keys. FIPS-validated modules are not claimed.
Information-security management system certification. Not begun.
Built toward WCAG 2.1 AA so agency users can meet their Title II obligation. Tested on October 7, 2026 with automated and scripted checks: ArmorList partially conforms today, with the failures found and the criteria not yet tested listed in the published VPAT / ACR, criterion by criterion. White text on brand orange, which measured 3.18:1, was replaced with navy text (5.05:1) on October 8, 2026.
Our privacy policy states what we collect, why, and the rights you can exercise. Data is hosted in the United States.
Our privacy policy covers California and other state privacy rights, including Global Privacy Control, and how to exercise them.
Catalog data is public product information. Controlled technical data is never published; classification stays with the manufacturer/exporter.
Our stack runs on AWS, Supabase, Cloudflare and Stripe, with no covered telecommunications or video surveillance equipment of our own. A written supply-chain risk plan is being prepared, and no Section 889 compliance is claimed until it is.
ArmorList is a public marketplace and does not process criminal-justice information. Agency custody data lives in ArmorTrack; no CJIS compliance is claimed for either platform.
No independent third-party penetration test has been completed yet.
Entity identifiers.
The legal entity behind ArmorList, for your vendor-onboarding and procurement files. Government registrations are shared with verified buyers and agencies on request.
Data verification & provenance.
This is what makes ArmorList different from a listings site. 14 official sources are read on a schedule today, and each company record shows how many of them confirmed it, and when. Automated checks re-run on a schedule: every day for the NIJ Compliant Products List, SAM.gov exclusions and the sanctions lists, and every week for SAM.gov registrations and state filings. Each reading is dated on the record. Each checked field carries its source, the date it was read, and a confidence of high, medium or low, set by how the match was made: an identifier, a name and country, or a name alone. A conflict between sources is held for review rather than silently overwritten, and each row below says whether its source is live.
Sourcing & data ethics.
The directory is built from public and authoritative records, plus information companies provide about themselves. We are explicit about the line between the two.
Data drawn from government registries and public filings is labeled with its source. We do not present a public-record value as a private claim, or a self-reported value as verified.
Any listed company can claim its profile, add verified detail, and request corrections. Verification does not require a paid subscription.
Sources are official registries and public information. We respect access controls and terms, and we do not resell raw third-party datasets.
ArmorList does not sell placement in search results. Sponsored slots, where they exist, are labeled. Results follow your query and spec; general listings then order by the status our team grants after review (Procurement Ready, Verified, Claimed, Listed), never by advertising.
Corrections & disputes.
When a value is wrong, there is a clear path to fix it, and the fix is evidenced.
Platform security controls.
TLS 1.2+ in transit, and AES-256 at rest applied by our hosting provider, which manages the keys. No customer data traverses a public network unencrypted.
Per-person permissions chosen at invite time, with no shared logins and no blanket admin role. Multi-factor authentication with an authenticator app is being enabled. Every organization's private data stays within its own workspace.
Every change to a company, product or material record, and every source reading, is written to a timestamped log that names who or what made it. Signed-in users see a record’s history.
What a buyer searches, saves, and shortlists is theirs. Suppliers see leads and aggregate engagement, never a buyer's full browsing history or unsent activity.
Encrypted, tested backups with defined RTO/RPO. Disaster-recovery practices keep the directory durable and available.
Changes reach production only through versioned releases that a person approves. No independent third-party penetration test has been completed yet; it is on the roadmap above.
Incident response & notification.
We maintain a tested incident-response plan and notify affected customers on a documented timeline, so your team can meet its own regulatory obligations.
Privacy & data protection.
ArmorList processes limited personal data, primarily business-contact details for account holders, plus the content of the RFIs and quote requests buyers choose to send. We honor data-subject rights uniformly across GDPR, UK GDPR, CCPA/CPRA, and the state privacy laws now in force.
Data map & retention.
Export control, EAR & ITAR for ballistic data.
Body armor is export-controlled. Most commercial soft armor falls under the EAR (ECCN 1A005 and related), while hard armor and inserts specially designed for military use can be ITAR-controlled under USML Category X. ArmorList publishes marketing-level product information, not controlled technical data, and keeps the line clear.
Accessibility, ADA Title II & WCAG 2.1 AA.
The DOJ's 2024 ADA Title II rule sets WCAG 2.1 Level AA as the technical standard for state and local government digital services, and it reaches apps provided through contractual arrangements. As a platform agency buyers use, our conformance supports yours. Compliance dates: April 26, 2027 for populations of 50,000+, April 26, 2028 for smaller entities.
We design for keyboard support, visible focus, an AA-contrast color system, semantic structure and ARIA, labeled forms and text alternatives. Today ArmorList partially conforms; our October 2026 review and the gaps still open are in the VPAT.
Our Accessibility Conformance Report (VPAT) documents conformance against WCAG 2.1 AA and Section 508, criterion by criterion, and is ready for your procurement file.
We do not rely on accessibility overlays; DOJ guidance and enforcement make clear they don't satisfy the rule. Conformance lives in the code.
Automated scans miss most issues, so conformance is validated with manual keyboard and screen-reader testing, tracked to remediation.
Procurement & contracts.
Document library.
Public documents are linked here. IntelAlytic has no SOC 2 report or penetration-test letter yet; when they exist, they will be shared under NDA during procurement.