Enterprise

Everything procurement needs, in one place.

Security, legal and procurement can self-serve most of the review here, with honest status on what exists today and dated plans for what does not.

Request a security reviewSee the pilot

Start with the document your team asks for first.

Trust centre

Security posture today, certification roadmap with dates, pen-test plan, insurance.

Learn more →

Data Processing Agreement

SCCs + UK Addendum, EU residency option, DORA clauses. Published ungated.

Learn more →

AI addendum

No training by default, model-change notice, EU AI Act Art. 50 transparency.

Learn more →

Sub-processors

Every LLM and infrastructure vendor, region and retention.

Learn more →

Rules of engagement

What our agents may do on your systems: modes, windows, stop protocol.

Learn more →

Agent identity

Web Bot Auth signature, key directory, how to allow-list or block us.

Learn more →

Terms / MSA

Authorised-testing safe harbour, liability caps, payments carve-outs.

Learn more →

SLA

Published only where contractually backed (Premier terms).

Learn more →

Acceptable use

Only properties you own or are authorised to test. No CAPTCHA bypass.

Learn more →

The controls security teams ask about, with honest status.

ControlStatusDetail
SSO (SAML: Okta, Entra)Q1 2027Included from Assurance Standard
Role-based access (viewer / operator / admin / approver)At launchApprover signs Test Authorizations and Commit-mode runs
Immutable audit log of every agent and human actionQ1 2027Export on Advanced
Stop before payment (non-overridable outside sandbox)At launchTest cards and sandboxes only
Per-origin rate limits, 429 / Retry-After honoured, kill switchAt launchDefault ≤ 2 concurrent sessions per origin
US / EU region, retention controls, zero-retention optionQ1 2027
PII / PAN redaction in screenshots and DOMLaterQ3 2027
SCIM provisioningLaterQ4 2027, Advanced
VPC runnerLaterPremier, after the Q1 2027 gate
SOC 2 Type IIn progressKick-off Q4 2026; report ≈ month 3
SOC 2 Type II · ISO 27001 · ISO 42001PlannedMonths 9-12 · 12-15 · 15-18
FAQ

Procurement questions

Do you have SOC 2?
Not yet, and we will not say otherwise. SOC 2 Type I kicked off in Q4 2026 with a report targeted around month 3; Type II follows in months 9-12. The trust centre shows the dated roadmap and what exists today.
Can you sign our DPA?
Yes. Our own DPA (2021 SCCs + UK Addendum, DORA ICT third-party clauses for EU financial services) is published ungated at /legal/dpa. We review yours in parallel with the pilot, not after it.
Which AI vendors see our data?
Only the model providers listed on sub-processors, with region and retention. No training on your data by default. You get notice before any model or vendor change.
Can agents run inside our cloud?
A VPC runner (runner + evidence store in your cloud, SaaS control plane) is on the roadmap for Premier after the Q1 2027 gate. Until then the local Scan extension covers authenticated staging apps without data leaving the machine.
How fast do you answer security questionnaires?
Target: under 10 business days. Pre-filled SIG Lite, CAIQ v4, AI-CAIQ and HECVAT are being prepared (month 4); until then we answer yours directly.

Run security review in parallel with the pilot.

Most pilots stall in procurement. We start legal and security in week one so the pilot result arrives to a signed contract.

See the pilot →Talk to us