OUTCOMESPLANET — SECURITY QUESTIONNAIRE (pre-filled)
outcomespalace.com · Updated 10 October 2026
Contact: support@outcomespalace.com · Privacy: privacy@outcomespalace.com

1. COMPANY AND CERTIFICATION
Q: Do you hold SOC 2 / ISO 27001 certification?
A: No. We do not claim certification before an accredited audit is complete. The controls such audits examine are in place and listed below. If certification is a procurement condition, contact us to discuss timing.

2. HOSTING AND DATA LOCATION
Q: Where is data hosted?
A: Managed cloud infrastructure. The hosting region is confirmed in writing before contract signature.
Q: Backups?
A: Automated daily backups with point-in-time recovery, managed by the hosting platform.

3. ENCRYPTION
Q: Data in transit?   A: TLS on all traffic.
Q: Data at rest?      A: Encrypted by the hosting platform.
Q: Passwords?         A: Never stored in readable form; hashed by the authentication service.

4. ACCESS CONTROL
Q: How is tenant data isolated?
A: Row-level security enforced in the database on every request, not only in the interface.
Q: Single sign-on?
A: Google sign-in for all accounts. SAML 2.0 SSO (Okta, Microsoft Entra ID, Google Workspace) for Institution accounts via guided setup with your IT team.
Q: Third-party (funder/advisor) access?
A: Role-based, scoped to one initiative, time-limited, revocable instantly with live sessions cut off. Every access is written to a tamper-evident access log.

5. LOGGING AND AUDIT
Q: Is there an audit trail?
A: Yes. Activity log exportable as CSV. Governance records are hash-chained and HMAC-signed with rotating key IDs; integrity verification can be run at any time and older signatures stay verifiable after key rotation.
Q: Retention?
A: Configurable audit retention per workspace.

6. GOVERNANCE CONTROLS
Two-person approval for funding releases, approver independence, signed decisions with consent, evidence freshness gates, separation of duties for policy authors, controlled rollback with rationale.

7. SUB-PROCESSORS
- Managed cloud hosting and database (application, data, authentication)
- Managed transactional email provider
- Managed AI gateway for coaching (customer content is not used to train models)
- Paddle (payments, merchant of record; we never see card details) — only when billing is active

8. MONITORING AND INCIDENT RESPONSE
Automated production checks every 15 minutes on key governance flows, with alerts after consecutive failures. Security reports acknowledged within three working days. Affected customers are notified without undue delay after a confirmed incident.

9. DATA PORTABILITY AND DELETION
Customers can export records at any time. Account deletion on request removes personal data, except records we are legally required to keep.

10. VULNERABILITY MANAGEMENT
Regular automated security scans of the database configuration and dependencies; findings are fixed before release.