Privacy, security, and the care we take with your records.
As an Alaska Native Corporation, we hold our shareholders' information to a high standard. This page explains how we collect, protect, retain, and govern data.
How we handle your information
Emmonak Corporation collects only the information needed to operate our businesses, serve our shareholders, and meet our legal obligations as an Alaska Native Corporation. This includes shareholder records, employment applications, customer and order information, and inquiries submitted through this website.
Shareholder data — names, addresses, share and beneficiary records, and Alaska Native enrollment information — is treated as highly sensitive. We maintain these records consistent with Bureau of Indian Affairs (BIA) recordkeeping expectations and ANCSA requirements, and we limit access to authorized personnel.
We do not sell personal information. We share information only with service providers acting on our behalf, with other Alaska Native corporations where ANCSA Section 7(i)/7(j) revenue sharing requires it, or where disclosure is required by law.
Using this website
This website is provided for informational purposes about Emmonak Corporation, its operating units, and shareholder and federal-contracting matters. Content may change without notice.
Forms submitted through this site (employment applications, records requests, inquiries) are routed to the appropriate Emmonak mailbox. Please provide accurate information; submitting false information may affect eligibility for employment, distributions, or services.
Emmonak Corporation trademarks, logos, and content are the property of the Corporation and its family of companies. Reproduction without permission is prohibited.
How we protect data
Email and document workflows run on Microsoft 365 with enterprise identity controls. Access to shareholder and corporate records is restricted by role, and administrative access is limited to a small number of authorized officers.
Inquiries and form submissions are transmitted over encrypted connections and delivered to monitored corporate mailboxes. We maintain audit copies of certain communications for compliance and recordkeeping.
We continuously improve our controls as the Corporation grows its federal-contracting footprint, including controls aligned to federal information-handling requirements for the work we pursue.
How long we keep records
Shareholder records are retained for the life of the shareholder relationship and as required for ANCSA, BIA, and corporate-governance purposes, including share inheritance and beneficiary administration.
Employment applications and related materials are retained consistent with applicable employment-law requirements. Customer and order records are retained for the periods required for accounting, tax, and warranty purposes.
Website inquiry records and audit copies of communications are retained for a limited period sufficient to respond to and document the matter, then disposed of securely.
Inherited platform controls
Emmonak Corporation's public websites are hosted on Vercel and version-controlled on GitHub — both independently audited platforms with active SOC 2 Type II and ISO 27001:2022 certifications. Under each provider's shared responsibility model, Emmonak inherits the platform-layer controls that make those certifications possible. The organization itself is not yet independently audited; see the roadmap below.
SOC 2 Type II
Vercel (web hosting) and GitHub (source control) both hold SOC 2 Type II attestations for Security, Availability, and Confidentiality. Emmonak inherits platform-layer controls under each provider's shared responsibility model.
Verify at provider’s trust center →ISO/IEC 27001:2022
Vercel and GitHub are both ISO 27001:2022 certified, covering their Information Security Management Systems. Emmonak's site infrastructure runs on this ISMS-certified stack.
Verify at provider’s trust center →Important disclosure. The certifications above are held by our platform providers, not by Emmonak Corporation. Emmonak has not independently pursued a SOC 2 or ISO 27001 audit of its own controls. Statements such as “Emmonak is SOC 2 certified” would be inaccurate; the correct framing is “Emmonak’s site infrastructure runs on SOC 2 Type II- and ISO 27001-certified platforms under a shared responsibility model.”
Frameworks we are pursuing
As Emmonak grows its federal-contracting work, we are building toward recognized security and assurance frameworks at the organizational level, above and beyond the inherited platform controls. These are in pursuit — not yet certified — and are listed transparently.
CMMC Level 2
Cybersecurity Maturity Model Certification — aligned to NIST SP 800-171 for protecting Controlled Unclassified Information in federal work. CMMC Level 2 requires the underlying cloud service provider to be FedRAMP Moderate authorized or equivalent; Emmonak will isolate any future CUI workloads on a FedRAMP-compliant enclave separate from this public site.
SOC 2 Type II (Emmonak-scoped)
Independent assessment of Emmonak Corporation's own controls — not just the underlying platforms. Distinct from the platform-inherited SOC 2 attestation Emmonak already relies on. Adds organizational-level assurance to the technical assurance already in place.
Questions about privacy or compliance?
Reach our compliance team at compliance@emmonak.com. We respond to data-access and records questions in the order received.