Answering a security review
How a Startup answers a security review from records it already keeps, with a trust page, live status, the scoped report, and sourced answers.
A Startup answers a Customer's security review from records it already keeps. The reviewer, person or agent, gets in minutes the answers an auditor takes weeks to test.
The trust page
Every Site serves a trust page at /systems/, as a page for people and as Markdown for agents. It shows:
- the frameworks the Startup is covered by, and its latest report period;
- the live result of every Control, from Trust status;
- the subprocessor list and the data processing agreement;
- a request form for the full report.
The report
A reviewer asks for the report on the trust page. The Startup's agent accepts a confidentiality Agreement by click-through and sends the Startup's scoped SOC 2 report. Each release is recorded, with who received it and when.
Questionnaires
Long questionnaires answer from records. The Sales Engineer reads each question, finds the Control, Proof or setting that answers it, and cites that source beside the answer.
A question no record answers goes to a Human as a Task. The approved answer is kept, so the next questionnaire that asks it answers itself.
Trust pack sends the report and prefilled answers with every enterprise Quote, before the reviewer asks.
Checking without trusting
A reviewer's agent can verify instead of trusting. It reads the Attestation and checks the firm's Credential at the source.
It then fetches a Proof, recomputes the hash chain for its range, and compares the result with the root the platform published. A match shows the Control ran over every record in that range.
Example
A two-person Startup sells an expense-audit agent to mid-size firms. A prospect's procurement team sends a 240-question spreadsheet. The Sales Engineer answers 231 from records in eleven minutes, and the founders answer the nine about how they work.
Next
- How proof works: what the reviewer's agent recomputes.
- Subprocessors: the list every review asks for.