The thirty questions that come up in procurement

Are you SOC 2 Type II?

Yes, annual report by an AICPA-registered firm; letter on /assurance.

Are you ISO 27001 certified?

Yes, with statement of applicability covering all customer-facing systems.

Where can I see your live posture?

Real-time identity, network and data posture is on /posture.

How are secrets stored?

AES-256-GCM under HSM-backed envelope keys; rotation register on /key-rotation.

Do you publish a penetration test letter?

Yes, annually and after major changes; letter in /assurance and the data room.

How do you handle vulnerabilities?

CVSS triage with publish-window SLAs; bulletins on /security-bulletins.

Do you isolate tenants?

Row-level + key-level isolation; cross-tenant access tested on every release.

What about supply chain?

SLSA L3, signed images, SBOM per release; details on /supply-chain.

Where is data stored?

EU-West primary with EU-North standby; HK region for APAC payouts only.

Do you process personal data?

Limited to workspace identity and audit metadata; full inventory on /datasets.

What is the retention schedule?

Published per dataset with legal basis on /retention.

Who are your sub-processors?

Full list with 30-day change notice on /legal/subprocessors.

Can I get a DPA?

Yes, EU SCC-aligned, signable in one round on /legal/dpa.

Do you train AI on customer data?

No; model cards on /model-cards spell out data sources for each feature.

What uptime do you commit to?

99.95% workspace, 99.99% ledger commit; history on /uptime-history.

What are your RTO/RPO targets?

Per-tier on /resilience; ledger RTO ≤ 15 min and RPO 0.

How do I know when you change things?

Change notice policy and minimum windows on /change-notice-policy.

Where do I see issued credits?

Public history on /sla-credits; per-tenant on /service-credits.

Do you run game days?

Yes, monthly per tier; outcomes logged on /tabletops.

Are you principal or agent for media spend?

Agent; full accounting note on /accounting-treatment.

Where is the price list?

Full SKU pricing in EUR on /price-list — no SSO tax.

What are your payment terms?

Net 30 default; Net 45 with credit on /credit; no surcharge below €50k MRR.

What is your indemnity cap?

Aggregate cap of 24 months of fees for security/IP; standard carve-outs.

Can I cancel mid-term?

Annual term; penalty-free exit on material breach or notice-policy miss.

What is your dependence on any one customer?

< 6% revenue from any single customer; concentration on /financial-statements.