Answer Library

Approved answers reused across questionnaires. Reuse is what makes the second questionnaire faster than the first — and consistent with it.

Contradictions (2)

We told different customers different things. Each pair below was approved by a human, which is exactly why it is worth catching here.

  • Log retention period

    Retention period: 12 months vs 90 days

    Northwind Bank — SIG Lite 2026

    “Security logs are retained for 12 months in hot storage and 7 years in archive.”

    Approved 4d ago

    Globex — CAIQ v4

    “Audit logs are retained for 90 days.”

    Approved Jul 1

  • Subprocessor objection window

    Objection window: 30 days vs 14 days

    Initech — Custom security review

    “Customers may object to a new subprocessor within 30 days of notice.”

    Approved Jul 27

    Globex — CAIQ v4

    “We provide 14 days' notice before engaging a new subprocessor.”

    Approved Jul 1

2 answers are past their review date. Stale answers get reused silently — that is how a wrong claim spreads.

  • How is data encrypted at rest?

    All production data is encrypted at rest using AES-256 via AWS KMS with customer-managed keys. Keys are automatically rotated every 90 days.

    Data ProtectionUsed 34×Last used 7h agoReview just nowOwner: Dhanush Singh

    Grounded in: Information Security Policy v4.2, Key Management Standard v2.0

    Active

  • Do you enforce MFA for administrative access?

    Yes. MFA is mandatory for all administrative access to production systems, enforced via our identity provider. Hardware keys are required for infrastructure administrators.

    Access ControlUsed 41×Last used 1d agoReview just nowOwner: Maya Chen

    Grounded in: Information Security Policy v4.2

    Active

  • What is your breach notification timeline?

    We notify affected customers without undue delay and in any event within 72 hours of confirming a personal data breach, per our DPA.

    Incident ResponseUsed 28×Last used 5d agoReview overdueOwner: Legal

    Grounded in: Data Processing Agreement

    Needs review

  • Do you use customer data to train AI models?

    No. Customer content is never used to train or fine-tune any model. Our model providers operate under zero-retention terms for inference requests.

    AI & Machine LearningUsed 19×Last used 3d agoReview just nowOwner: Dhanush Singh

    Grounded in: AI Governance Policy

    Active

  • What is your RPO and RTO?

    RPO is 5 minutes via continuous WAL archiving. RTO is 1 hour. Recovery is tested quarterly and results are documented.

    Business ContinuityUsed 12×Last used Jul 9Review overdueNo owner

    No supporting evidence linked — this answer cannot be verified.

    Needs review