Specific questions deserve specific evidence.
The topics below are the technical review agenda. Except for the hosting information above, these details require confirmation for the scoped deployment; they are not certification or control attestations.
- Identity and access
- Confirm the authentication method, available roles, tenant isolation and how source permissions apply. SSO and MFA availability need technical confirmation.
- Encryption and storage
- Confirm encryption in transit and at rest, key ownership and each store used by the scoped deployment. Agree what selected context, caches and logs retain.
- Backup and recovery
- Confirm backup locations, retention, restore procedures and recovery responsibilities. Production hosting alone does not establish backup residency or recovery targets.
- Retention and deletion
- Agree retention periods, export options, deletion procedures and the handling of derived records and backups. No deletion deadline is promised here.
- AI processing and subprocessors
- Confirm which providers receive which fields, their processing locations, applicable retention/training terms and any agreed pseudonymization. Do not assume all processing stays in the hosting region.
- Actions and accountability
- Confirm supported read and write paths, who approves an action, what is logged and who may access customer data. Autonomous execution is not implied.
- Support and incident routing
- Agree support ownership, incident contacts, escalation and notification commitments in the deployment scope. The founders can route a technical question; this is not a published incident-response SLA.