Orbit Media

On Track

qn-007 · Media & SaaS

Deal stage: Renewal
Deal value: $90,000
Questions: 4
Received: May 24, 2026
Due: Jun 28, 2026 (27d)

Encryption & Data Protection · q-032

Confirm the TLS standards used for data in transit.

100confidence

Auto-Approved

Drafted response

Data in transit is protected using TLS 1.2 or higher; SSL and TLS 1.0/1.1 are disabled and HSTS is enforced on public endpoints.

Confidence factors

Control Match4/4weight ×2.0
How directly approved controls answer the question.
Evidence Freshnessderived4/4weight ×2.0
Currency of the mapped evidence (derived from review dates).
Approved Language4/4weight ×1.5
Availability of vetted, pre-approved response language.
Answer Reuse4/4weight ×1.5
Consistency with prior approved responses to the same ask.
Category Clarity4/4weight ×1.0
How standard and well-bounded the question is.

Mapped evidence

SEC-ENC-002Encryption in TransitCurrent

Routed toAuto-Approved

Why this verdict

Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.

Access Control & Identity · q-033

Is access reviewed periodically and revoked on offboarding?

100confidence

Auto-Approved

Drafted response

Access is reviewed quarterly and revoked promptly on role change or offboarding, following least-privilege provisioning.

Confidence factors

Control Match4/4weight ×2.0
How directly approved controls answer the question.
Evidence Freshnessderived4/4weight ×2.0
Currency of the mapped evidence (derived from review dates).
Approved Language4/4weight ×1.5
Availability of vetted, pre-approved response language.
Answer Reuse4/4weight ×1.5
Consistency with prior approved responses to the same ask.
Category Clarity4/4weight ×1.0
How standard and well-bounded the question is.

Mapped evidence

SEC-IAM-010Access Control & RBACCurrent

Routed toAuto-Approved

Why this verdict

Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.

Compliance & Certifications · q-034

Do you hold current SOC 2 and ISO 27001 certifications?

97confidence

Auto-Approved

Drafted response

Yes. We maintain a SOC 2 Type II report and ISO/IEC 27001 certification, available under NDA through the trust portal.

Confidence factors

Control Match4/4weight ×2.0
How directly approved controls answer the question.
Evidence Freshnessderived4/4weight ×2.0
Currency of the mapped evidence (derived from review dates).
Approved Language4/4weight ×1.5
Availability of vetted, pre-approved response language.
Answer Reuse4/4weight ×1.5
Consistency with prior approved responses to the same ask.
Category Clarity3/4weight ×1.0
How standard and well-bounded the question is.

Mapped evidence

CMP-CERT-090Compliance CertificationsCurrent

Routed toAuto-Approved

Why this verdict

Strong control match on current, approved evidence with no sensitivity flags — cleared to auto-approve.

Vendor & Third-Party Risk · q-035

Describe vendor risk management for your subprocessors.

84confidence

Suggested

Drafted response

Subprocessors are risk-assessed before onboarding and reassessed periodically by data sensitivity, with requirements flowed down through contractual terms.

Confidence factors

Control Match3/4weight ×2.0
How directly approved controls answer the question.
Evidence Freshnessderived4/4weight ×2.0
Currency of the mapped evidence (derived from review dates).
Approved Language3/4weight ×1.5
Availability of vetted, pre-approved response language.
Answer Reuse3/4weight ×1.5
Consistency with prior approved responses to the same ask.
Category Clarity4/4weight ×1.0
How standard and well-bounded the question is.

Mapped evidence

VR-TPR-080Vendor & Third-Party Risk ManagementCurrent

Routed toSecurity Enablement

Why this verdict

Confidence score of 84/100 lands in the Suggested band — a solid draft that benefits from a light review before sending.