Enterprise review has four gates (security, legal, AI governance and procurement), and each one asks for different paper. This page is the index: what exists, what arrives on request, what is still being prepared, and what we do not have, with the reason.
The list below includes things we cannot give you. That is deliberate. A vendor page listing only the favorable answers forces you to discover the gaps by asking, which is slower for both of us and reads worse when you find them.
Roughly half your questionnaire will be not-applicable.
Most vendor assessments are written on the assumption that the vendor holds the data. That assumption does not hold here, and it is worth establishing before your team spends a week on sections that cannot apply.
A vendor holding your data.
- ↗Data-center and physical security controls
- ↗Cloud hosting and tenancy isolation
- ↗Vendor backup and recovery of your data
- ↗Data residency and cross-border transfer
- ↗Sub-processors and onward disclosure
- ↗Vendor breach of your data
You hold it. We never receive it.
Every item opposite is a question about infrastructure you provide. We are not declining to answer. There is no vendor-side system for those controls to describe.
One exception is yours to make: cloud processing. It is off by default. If an administrator turns it on for a catalog, that catalog's GPU work goes, encrypted end to end, to a cloud GPU provider you choose, and residency, transfers and sub-processing then apply to that provider. Answer those sections for it, not for us.
- ▸No processing of your media by us, so no Article 28 agreement with us to govern it
- ▸No sub-processors of ours; a cloud GPU provider you choose is yours
- ▸Nothing sent to us, and in the standard install nothing leaves your network
- ▸No standing vendor access to your deployment
The questions that do apply, we answer in full. See all fifty
What we can put in front of you.
Read on this site
- Security architecture overview
- Deployment model, network surface, identity and access, encryption, biometric handling, audit, supply chain, and the limits.
- Pre-answered security questionnaire
- The fifty questions that recur across SIG-Lite, CAIQ, VSAQ and HECVAT, answered. Downloadable to attach to a ticket.
- Shared responsibility model
- Line by line, what we are responsible for and what you are. Shorter on our side than you may be used to.
- Data inventory and flow
- Every class of data the system creates, where it lives, who can reach it, and what happens when it is deleted.
- AI and biometric governance
- Intended use, prohibited use, accuracy and its limits, human oversight, how your media is never used for training, and the EU AI Act position.
- Vulnerability disclosure policy
- Where to report, what response to expect, and safe-harbor terms for good-faith research.
- DPIA support pack
- The systematic description of processing, data categories, recipients, retention and deletion mechanics, Article 32 measures, and the residual risks we think are real.
Sent on request
- Completed SIG-Lite / CAIQ / HECVAT
- Send us your framework's workbook and we will return it completed rather than asking you to map our prose onto it.
In preparation
- Detailed architecture and data-flow diagrams
- Component-level diagrams with trust boundaries and port inventory, for a reviewer who needs more than the overview.
- Software bill of materials
- Third-party component inventory with versions and licenses, for supply-chain review and for your legal team's attribution obligations.
- CycloneDX, generated against the exact release you are running rather than a generic one, once the release pipeline is in place.
- Deployment hardening guide
- How to stand the system up to the configuration we would run ourselves, including the settings that fail closed.
- Open-source license inventory
- Components and their licenses, with the attribution text. Usually what legal actually wants when they ask for the SBOM.
Not held, and why
- SOC 2 Type II report
- An attestation over a service organization's controls. We do not operate a service that touches your media, so the controls it would cover are not in your data path.
- Tell us if your policy requires one regardless of architecture. It is a fair requirement and we would rather know early than at contract.
- ISO 27001 certificate
- Certification of an information security management system. Not held.
- Same question applies, and the same answer: ask us early rather than late.
- Penetration test report
- No third-party penetration test has been commissioned.
- You are free to test your own deployment; good-faith research is explicitly welcome.
- Data processing agreement
- In the standard install we never receive your data, so we are not a processor of it and there is no processing for an Article 28 agreement with us to govern. If you turn on cloud processing, the GPU provider you choose processes that work for you and is your sub-processor, not ours. If you ask us to host the relay that routes that work (an added service), it forwards encrypted work it cannot read, and we cover it, including where it runs, in a processing agreement with you.
- If your process requires a signed DPA anyway, we will sign one covering support interactions. Just do not mistake it for us processing your media.
- Sub-processor list
- We have none for the product. In the standard install nothing in the processing path is operated by anyone other than you. If you turn on cloud processing for a catalog, the cloud GPU provider you choose is your sub-processor, under your agreement with them. If you ask us to host the relay that routes that work (an added service), it forwards encrypted work it cannot read, and we cover it, including where it runs, in a processing agreement with you.
- Data residency attestation
- Your infrastructure, your residency. We cannot attest to where your data lives because we are not the ones holding it. With cloud processing on, the region is the one your chosen GPU provider runs in.
- VPAT / accessibility conformance report
- No formal conformance report has been produced for the interface yet.
- Required by most US federal and university procurement. Raise it early if it is a gate for you.
- Cyber liability insurance certificate
- Not published here.
- Ask and we will tell you what is in place at the time you ask.
- Source code escrow
- No standing arrangement. We will enter one as a contract term if you need it.
- The usual answer to “what happens to us if you stop existing”, and a reasonable thing to want for software you run yourself.
The order that wastes least of your time.
Read the architecture
Fifteen minutes on the security page answers most of what a first-pass review asks.
Take the answers
The questionnaire downloads as a file you can attach to your ticket.
Send us the gaps
Your own workbook, the items above marked on request, and anything your policy requires regardless.
Talk to an engineer
Not a solutions consultant reading from the same page you just read.
Send us the questionnaire.
Your framework's workbook comes back completed rather than mapped onto our prose. Tell us which gates you have to clear and we will tell you which ones we can.