Controlled packet
- Matching individual-supplier and applicable tax documents
- Remittance instructions and sanctions declaration
- Current insurance certificates, when held
- Security and no-data-processing attestations
- Signed NDA and contract fallbacks
Procurement readiness
Classify the engagement before the questionnaire classifies it
A compact diligence surface for a fixed-scope, no-production-access advisory engagement. Controlled identifiers and signed forms are supplied as a matching packet.
Contracting supplier
Vikram Jha
Individual independent consultant
Tax resident in India
Invoices issued from India
Vikram Jha — Defensible AI is the practice name, not a separate company or legal entity. Residential address and tax identifiers are supplied only in controlled onboarding and invoice documents; they are not published on this website.
Continuity and key-person risk
The engagement is principal-led by design, so the continuity answer is contractual rather than reassuring. It is stated here because a reviewer should not have to ask.
- A second principal is named at contracting — disclosed to the client, under NDA where diligence requires it, and able to take the work forward.
- Deliverables are yours as they are produced, not on completion. There is no point at which work exists only on my machine.
- Decisions, sources, assumptions and open actions live in your workspace throughout, so a handover starts from a written record rather than from someone’s private context.
- A key-person clause is agreed before signature where you require one — not negotiated after an incident. Documentation escrow can be arranged on the same basis; no standing arrangement is claimed above because none is currently held.
- The engagement is designed to end. Its purpose is a governance layer your team operates without me; a dependency on my availability would be a defect in the deliverable, not a feature of the relationship.
| Control | Published position |
|---|---|
| Engagement classification | Fixed-scope professional advisory. No production operation, no ongoing managed service, no customer-data processing and no access to a critical system unless a signed scope explicitly says otherwise. |
| Security posture | Client-tenant first; least-privilege named access; MFA; encrypted transport; synthetic examples; no shared credentials; no confidential client material in public AI services. |
| Data processing | The default scope is designed so no personal data is processed. If a buyer requires a fallback DPA despite that scope, the no-data recital and permitted processing are documented rather than argued orally. |
| Subprocessors | None for advisory delivery by default. Hosting and analytics used by this public website are described separately on the privacy page and do not receive client work product. |
| Contract posture | Mutual NDA; client ownership of paid deliverables; bounded use of pre-existing methods; written change control; liability allocation proportionate to the fixed scope; no silent product recommendation. |
| Commercial mechanics | Fixed scope, mobilization invoice on signature, a second invoice against delivery, and jurisdiction-specific tax or withholding language reviewed before execution. |
| Professional indemnity / E&O | Certificate and limit are not claimed publicly until a current COI is configured. |
| Cyber insurance | Certificate and limit are not claimed publicly until a current COI is configured. |
| Standard questionnaires | SIG Lite and CAIQ are completed against the same published positions on this page, so an answer returned to your third-party risk team cannot disagree with what is stated here. Supplied in the controlled packet on request; no bespoke portal onboarding is required to see the substance first. |
| Documentation escrow | Can be arranged where continuity is a formal control, on the same terms as any other pre-signature requirement. No standing arrangement is claimed here, because none is currently held — and working artifacts already sit in the client workspace throughout, so escrow would cover the residual rather than the whole. See continuity above. |
| Key-person substitution | A named second principal is disclosed at contracting. Substitution terms are agreed before signature rather than after an incident. |
Related public controls
Public drafting baselines
These are reviewable starting points, not signed representations. Buyer-specific identifiers, evidence and counsel-approved language belong in the controlled packet.
Next step
Need the controlled packet?
Name the buyer, jurisdiction and supplier questionnaire. The matching documents should travel together so vendor-master, tax form and invoice cannot disagree.