Trust Center

What exists, and what does not.

The current public offer is a manual assessment. Published information is linked below. Documents that are not published need a direct availability check before they can be relied on in procurement.

Ask us anything

Procurement artefacts

Coordinated disclosure policy
Read the public disclosure policy.
Published
Assessment scope
Inputs, deliverables and limits of the manual assessment.
Published
Assessment terms and data handling
Read the terms and agree any engagement-specific requirements before transferring files.
Published
Product architecture & data-flow description
No software-platform architecture document is published here.
Not published
Data Processing Agreement (DPA)
Ask about availability and review requirements before an engagement.
Not published
Master Services Agreement
Engagement terms must be agreed directly; no MSA template is published here.
Not published
Business Associate Agreement (BAA)
Not currently offered. Do not send PHI through the public contact form.
Not yet
SOC 2 Type II report
No report is available on this site.
Not published
ISO 27001 certificate
Not held.
Not yet
Penetration test summary
No external report or test schedule is published here.
Not published
SBOM
No product software bill of materials is published here.
Not published
Service Level Agreement
The manual assessment does not include a software availability SLA.
Not published

Website services

These services are referenced by the website. Which optional services are active, their processing regions and their contractual status need confirmation. This is not a verified subprocessor register for an assessment or a private application.

RailwayWebsite hosting configuration; confirm the live deployment and processing region before relying on them.
ResendContact email delivery when enabled.
Upstash RedisContact abuse limits when configured; receives keyed email hashes and temporary counters, not enquiry contents.
Configured webhook destinationAdditional contact delivery when enabled; request the destination before sharing sensitive context.
PlausibleWebsite analytics when enabled.
Google FontsThe website requests font styles and files from Google.

This website has no model-provider integration. Use the contact form for general enquiries only; agree assessment data handling separately.

If you need something else

Send the questionnaire. We will complete it honestly, which at this stage means a lot of “not yet” — and we would rather you have that in week one than week six.

For questions about assessment scope, data handling or required agreements, start a conversation before sending any assessment files.

Send us your questionnaire