Classify the engagement before the questionnaire classifies it
A compact diligence surface for a fixed-scope, no-production-access advisory engagement. Controlled identifiers and signed forms are supplied as a matching packet.
Published positions
Engagement classification
Fixed-scope professional advisory. No production operation, no ongoing managed service, no customer-data processing and no access to a critical system unless a signed scope explicitly says otherwise.
Security posture
Client-tenant first; least-privilege named access; MFA; encrypted transport; synthetic examples; no shared credentials; no confidential client material in public AI services.
Data processing
The default scope is designed so no personal data is processed. If a buyer requires a fallback DPA despite that scope, the no-data recital and permitted processing are documented rather than argued orally.
Subprocessors
None for advisory delivery by default. Hosting and analytics used by this public website are described separately on the privacy page and do not receive client work product.
Contract posture
Mutual NDA; client ownership of paid deliverables; bounded use of pre-existing methods; written change control; liability allocation proportionate to the fixed scope; no silent product recommendation.
Commercial mechanics
Fixed scope, mobilization invoice on signature, a second invoice against delivery, and jurisdiction-specific tax or withholding language reviewed before execution.
Professional indemnity / E&O
Certificate and limit are not claimed publicly until a current COI is configured.
Cyber insurance
Certificate and limit are not claimed publicly until a current COI is configured.
Standard questionnaires
SIG Lite and CAIQ are completed against the same published positions on this page, so an answer returned to your third-party risk team cannot disagree with what is stated here. Supplied in the controlled packet on request; no bespoke portal onboarding is required to see the substance first.
Documentation escrow
Can be arranged where continuity is a formal control, on the same terms as any other pre-signature requirement. No standing arrangement is claimed here, because none is currently held — and working artifacts already sit in the client workspace throughout, so escrow would cover the residual rather than the whole. See continuity below.
Key-person substitution
A named second principal is disclosed at contracting. Substitution terms are agreed before signature rather than after an incident.
Continuity and key-person risk
The engagement is principal-led by design, so the continuity answer is contractual rather than reassuring. It is stated here because a reviewer should not have to ask.
A second principal is named at contracting — disclosed to the client, under NDA where diligence requires it, and able to take the work forward.
Deliverables are yours as they are produced, not on completion. There is no point at which work exists only on my machine.
Decisions, sources, assumptions and open actions live in your workspace throughout, so a handover starts from a written record rather than from someone’s private context.
A key-person clause is agreed before signature where you require one — not negotiated after an incident. Documentation escrow can be arranged on the same basis; no standing arrangement is claimed above because none is currently held.
The engagement is designed to end. Its purpose is a governance layer your team operates without me; a dependency on my availability would be a defect in the deliverable, not a feature of the relationship.
Public drafting baselines
These are reviewable starting points, not signed representations. Buyer-specific identifiers, evidence and counsel-approved language belong in the controlled packet.
Need the controlled packet?
Name the buyer, jurisdiction and supplier questionnaire. The matching documents should travel together so vendor-master, tax form and invoice cannot disagree.