| Your form asks about | Where it is answered |
|---|---|
| Authentication, single sign-on, identity federation, how internal API calls are secured | The security page → |
| Roles and permissions, who can see or edit what, temporary access, approval chains | The access control page → |
| Hosting, tenancy, how a release reaches your environment, backups, replication | The deployment page → |
| What personal data is held, the audit trail, retention, data residency, subject rights | The data protection page → |
| Service commitments, recovery-time and recovery-point targets, support response times, certifications, vendor continuity or escrow commitments | Standard SaaS includes a 99.5% uptime SLA, daily backups and automatic updates on Microsoft Azure in the EU. Support is optional. Other commitments and assurance requirements depend on the deployment and contract.Deployment and service terms → |
| Price, licence tiers, a rate card | Published in full, with the rule that derives every figure. A binding offer is issued per organisation, in writing. Read the rate card → |
Trust
Four pages, each a mechanism, for the box on your form that asks about it
Somewhere in your questionnaire is a field asking about encryption, tenancy or who can see what. This section is written for that field, not for a sales conversation. Below it is a short, honest list of the lines your form has: which ones we answer with a published number, and why the rest are answered against the deployment shape you choose.
Read the mechanism, not the summary
The four pages
Mechanism
Security
Authentication through your identity provider, the internal call gate, three layers of authorisation, transport security and how stored employee documents are encrypted.
Mechanism
Access control
Sixteen securable areas, a seven-level membership ladder applied independently to read and write, the write-clamped-to-read invariant, temporary roles and eligible approvers.
Mechanism
Deployment
Managed cloud, a dedicated cluster, or your own infrastructure: what you operate in each, where data sits, how a release ships, and how backups and replication actually work.
Mechanism
Data protection
What personal data the system holds and why, the audit trail, document encryption, retention as a configuration, and the subject-rights position stated plainly.
If you are the one filling in the form rather than the one being asked, the companion page for your role is the IT security desk, which puts eleven of the most common questions in one table with a straight answer to each. Once you are past the questionnaire stage, the evaluation hub has the tools for testing a claim rather than reading one.
Bring the actual form.
A working session is 45 minutes with your questionnaire open, not a canned demo. Whatever line does not have a page here yet gets a specific, written answer for your deployment shape.