Optional preview page
SAMPLE / edit to match your stack. These drafts ship with fill-in blanks. They are educational templates — not claims about your company, and not a SOC 2 audit, attestation, or certification. Have counsel/auditor review before you submit answers to customers.
SAMPLE
Q: Where is customer data stored?
Draft: Customer data for {{product_name}} is stored in {{cloud_provider, e.g. AWS / GCP / Azure}} in {{primary_region, e.g. us-east-1}}. We do {{or do not}} replicate to {{secondary_region_or_none}}. We do not store customer data on employee laptops as a system of record.
SAMPLE
Q: How is data encrypted at rest?
Draft: Data at rest is encrypted using {{encryption_at_rest, e.g. AES-256 via cloud-provider managed disk / volume encryption}} on {{storage_services}}. Application-level field encryption is {{used_for / not used for}} {{fields_if_any}}.
SAMPLE
Q: Do you enforce multi-factor authentication (MFA)?
Draft: MFA is {{required / encouraged}} for {{who, e.g. all employees with production or customer-data access / all workspace admins}}. Customer-facing MFA is {{supported_via, e.g. TOTP / SSO IdP MFA / WebAuthn}} on {{plans}}.
SAMPLE
Q: What is your employee offboarding process for access?
Draft: On termination or role change, we revoke access to {{systems_list, e.g. IdP, email, cloud console, code repos, production, SaaS admin}} within {{target_timeframe, e.g. same business day}}. Offboarding is tracked via {{checklist_or_ticket_tool}}.
Full pack includes ~40 drafts, trust-page skeleton, subprocessor CSV, SOP stubs, evidence index, and START-HERE.
All sales final · educational templates only · not a certification