Review the evidence and contract requirements.
Review public summaries, draft terms and items that need further evidence. Procurement must confirm the applicable controls, documents and signed commitments for your requirements.
Data Processing Addendum (DPA)
Draft DPA summary for procurement review. Customer-specific processing, transfer and retention terms require legal review.
Master Services Agreement (MSA)
Request review of confidentiality, IP ownership, support and data rights. A shareable MSA and approved terms must be confirmed during procurement.
SLA excerpt
Draft SLA summary with availability and support targets for procurement review. Exact commitments require agreed scope and signed terms.
Subprocessors
Current dependency categories include hosting, Postgres/auth/storage, transactional email, product analytics, and marketing-site advertising conversion measurement. Enterprise buyers receive the named list and change-notice process in procurement.
Security review packet
Secure SDLC notes, dependency management, vulnerability handling, and current assessment status. Third-party penetration-test artifacts are shared when available; no completed test is claimed here.
Data residency & region pinning
Region requirements are scoped during enterprise review. Dedicated-region or single-tenant deployments require explicit contract scope and implementation planning.
SOC 2 readiness status
Request current readiness materials and control evidence during enterprise review. No SOC 2 Type I or Type II report is claimed until an available report can be reviewed under NDA.
Privacy impact review
Request review of lawful basis, data categories, retention, minimization, deletion and customer responsibilities. A completed DPIA or shareable worksheet must be confirmed during review.
AI governance addendum
Tenant-level policy for external LLM use, PII redaction, prompt retention, agent run budgets, approval gates, and model/provider controls.
Regulated-workload posture
Honest status on the controls public-sector and regulated-industry buyers ask about first. We call out “in progress” and “planned” explicitly so your procurement team can plan around reality, not marketing.
- PlannedRequest briefing
FedRAMP Moderate
Not authorized today. We can support a readiness discussion for regulated buyers, but we will not claim "FedRAMP authorized" until a formal authorization letter exists.
- Planned
Sovereign single-tenant deployment
Dedicated infrastructure, customer-managed keys, and BYOC are not established as available by this page. Buyer requirements need architecture review, delivery ownership, and an approved implementation plan before a commitment.
- Planned
AWS GovCloud / Azure Gov
Not available today. No delivery date or authorization is committed here; any proposed deployment requires a separate feasibility and procurement review.
- PlannedRequest briefing
CMMC Level 2
No CMMC certification or completed assessment is claimed. Request a review of your requirements and the current evidence before considering this scope.
Vendor security review short-form
Send your questionnaire and required evidence for review. Availability of completed answers and supporting artifacts must be confirmed for your scope.
CAIQ (Lite)
Request review of the cloud-security questions and supporting evidence your team requires.
SIG Core
Scope questionnaire support and required artifacts during enterprise review.
OWASP ASVS checklist
Request review of application-security requirements and any available control mapping.
Custom questionnaire turnaround
Turnaround is scoped by contract stage, questionnaire size, and requested evidence.