PROCUREMENT & COMPLIANCE
Everything your review will ask for, in one place.
How we contract, what documentation you get and when, and which things depend on your region and entity rather than being true everywhere. If your review needs something that is not here, ask. We would rather tell you now that we cannot meet it than three months into a process.
NOTE
Certifications, clearances, insurance limits and vendor-of-record listings differ by region and legal entity. We confirm yours in writing during qualification. We deliberately do not list them here, because a list that is true in one country is misleading in another.
Direct or channel
Direct agreements, MSP and VMS programs, frameworks, or subcontract.
Risk documentation
Risk questionnaires answered, subcontractors disclosed, exit planned.
Security posture
Who can reach what, where it lives, how long we keep it, what happens if it goes wrong.
Accessibility
WCAG 2.2 AA, plus local standards, with the testing evidence to show for it.
DOCUMENTATION
What we provide, and when.
Most of it we can send you the same day. The rest we produce during qualification, before anyone talks about price.
Capability statement
Company details, regions, engagement models, security and accessibility posture. Ask and we send it.
Third-party risk pack
Your questionnaire completed, subcontractors disclosed, concentration and exit addressed. During qualification.
Security documentation
Access model, residency options, retention schedules, and what we do when something breaks. During qualification.
Insurance and entity details
Certificates and entity details for the region you are contracting in. During qualification.
Accessibility evidence
How we approach it, how we test it, and what we know is still not right. On request.
Reference architecture
How the products in scope deploy, integrate and handle identity. On request.
DATA & AI GOVERNANCE
The three questions that decide most reviews.
QUESTION 01
Where does data live?
You choose, per deployment, and it goes in the agreement.
North America, Europe, India and APAC
We tell you who our sub-processors are
Retention and deletion schedules in writing
QUESTION 02
Who can access it?
Least privilege, behind SSO, logged, and reviewed on a schedule.
Role-based access, per tenant
Admin actions are logged
Access reviewed every quarter
QUESTION 03
How is AI governed?
Explainability and human sign-off are build requirements, not features we added later.
Every score opens up to show its evidence
Models versioned and written up
Human decisions recorded for audit
Send us the questionnaire.
We will fill it in against whatever is in scope, and flag anything we cannot meet before you spend more of your review on us.