TrustDesk
Synthetic demo data
Back to workspace

Northwind Capital

At Risk

qn-001 · Financial Services

Deal stage
Renewal
Deal value
$480,000
Questions
5
Received
May 19, 2026
Due
Jun 8, 2026 (7d)
Encryption & Data Protection · q-001

Describe how customer data is encrypted at rest and in transit.

100confidence
Auto-Approved
Drafted response

Customer data is encrypted at rest using AES-256 across all production data stores and backups, and in transit using TLS 1.2 or higher with legacy protocols disabled.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived4/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language4/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse4/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity4/4weight ×1.0

    How standard and well-bounded the question is.

Routed toAuto-Approved

Why this verdict

  • Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.
Encryption & Data Protection · q-002

How are encryption keys managed and rotated?

83confidence
Suggested
Drafted response

Keys are managed in a dedicated, hardware-backed KMS, rotated at least annually and on personnel change, with access restricted by least privilege.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived2/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language4/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse3/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity4/4weight ×1.0

    How standard and well-bounded the question is.

Mapped evidence

Routed toSecurity Enablement

Why this verdict

  • Evidence Freshness is below target (2/4).
Access Control & Identity · q-003

Is multi-factor authentication enforced for administrative access?

100confidence
Auto-Approved
Drafted response

Yes. MFA is enforced for all employee and administrative access, with phishing-resistant factors required for privileged roles via federated SSO.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived4/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language4/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse4/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity4/4weight ×1.0

    How standard and well-bounded the question is.

Mapped evidence

Routed toAuto-Approved

Why this verdict

  • Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.
Vulnerability Management · q-004

What is your patch management SLA for critical vulnerabilities?

75confidence
Needs Review
Drafted response

Security patches are prioritized by severity; critical vulnerabilities are remediated within defined SLA windows and tracked to closure.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived0/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language4/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse4/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity4/4weight ×1.0

    How standard and well-bounded the question is.

Mapped evidence

Routed toSecurity SME

Why this verdict

  • Capped at Needs Review: mapped evidence is expired, overriding a numeric score of 75. A confident answer on stale evidence is still a stale answer.
Compliance & Certifications · q-005

Do you maintain a SOC 2 Type II report and ISO 27001 certification?

100confidence
Auto-Approved
Drafted response

Yes. We maintain a SOC 2 Type II report and ISO/IEC 27001 certification, available to customers under NDA through the trust portal.

Confidence factors

  • Control Match4/4weight ×2.0

    How directly approved controls answer the question.

  • Evidence Freshnessderived4/4weight ×2.0

    Currency of the mapped evidence (derived from review dates).

  • Approved Language4/4weight ×1.5

    Availability of vetted, pre-approved response language.

  • Answer Reuse4/4weight ×1.5

    Consistency with prior approved responses to the same ask.

  • Category Clarity4/4weight ×1.0

    How standard and well-bounded the question is.

Routed toAuto-Approved

Why this verdict

  • Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.