Posture
Where we stand on the frameworks that matter for SaaS evaluation.
| Framework | Status | Evidence available |
|---|---|---|
| GDPR (EU + UK) | Aligned | DPA, SCCs, UK IDTA, DPIA support, sub-processor list |
| SOC 2 Type II | In progress — target audit Q4 | Readiness assessment letter, control narrative, trust gap letter, security pack |
| HIPAA | On roadmap | Architecture review for Enterprise pilots; BAA available on request for qualifying pilots |
| ISO/IEC 27001 | On roadmap | Mapped controls available; Statement of Applicability draft on request |
| CCPA / CPRA | Aligned | Privacy notice, consumer-rights workflow, "do not sell" attestation |
| PCI-DSS | Out of scope (tokenised) | Card data handled by PCI-DSS Level 1 processor; we do not store PAN |
| NIST CSF | Mapped (informational) | Control mapping available on request |
Aligned = we operate to the standard and can evidence the controls; not equivalent to third-party certification. In progress = an active audit is underway with a named auditor partner. Roadmap = scoped, prioritised, and on the public commitment list — pilots possible on request.
GDPR
What “GDPR-aligned” means in practice.
We are a processor for customer content (recordings and the evidence layer derived from them) and a controller for account and usage data. In practice this means:
- Data Processing Addendum (DPA). Available on request and signed before customer content flows. Incorporates EU SCCs (2021) and the UK IDTA. Pre-signed countersigned copy returned within one business day.
- Lawful basis. Contract for service delivery; legitimate interests for security, abuse prevention, and product improvement; consent for opt-in communications. Documented per processing purpose on /privacy.
- DSAR handling. SLAs published in /privacy. Verified-identity workflow. We assist customer-controllers with DSARs against their workspace data within 10 business days.
- DPIAs. We provide a DPIA support pack including data flow diagrams, sub-processor list, residency map, and risk-treatment narrative.
- Records of processing (Art. 30). Maintained internally; relevant excerpts shared under NDA.
- Sub-processor change notice. 30 days’ advance notice via the trust portal; objection rights per the DPA.
SOC 2
In progress, with a target Q4 audit window.
- Where we are. Readiness assessment is complete. Controls operate across the five Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). Evidence collection is automated through our compliance platform.
- Audit partner. Engaged with a recognised CPA firm (named under NDA in the security pack).
- Target. Type II report covering an observation window ending Q4. We will publish the report (NDA-gated) when issued.
- Available today. Trust gap letter, control narrative aligned to AICPA TSC, sample audit-log export, pen-test executive summary, architecture diagram, data-flow narrative.
What we don’t claim. We do not claim a SOC 2 certification today. We will not say "SOC 2 compliant" until the report exists. If you see anyone repeat that on our behalf, please flag it to security@citesvue.com.
HIPAA
On the roadmap. Pilot-available for qualifying Enterprise customers.
- Status. HIPAA-readiness work is scoped on the public roadmap. Production HIPAA support — including default BAA and PHI-suitable defaults — is not generally available.
- What’s possible today. For Enterprise customers with a qualified pilot use case (typically: limited PHI, defined retention, single-region pinning), we can sign a BAA, configure PHI-suitable defaults, and disable specific sub-processors that aren’t in your BAA scope.
- What we don’t do. We don’t recommend running production PHI workloads on the standard cloud tier today.
ISO 27001
On the roadmap, with controls already mapped.
- Status. ISO 27001 certification is on the public roadmap, scheduled to follow SOC 2 Type II issuance.
- Available today. Annex A control mapping, draft Statement of Applicability, and ISMS scope document on request under NDA.
- Approach. SOC 2 first because the overlap is large and most customer questionnaires we see lead with SOC 2.
CCPA / CPRA
California rights honoured. Nothing sold.
- No sale of personal information. We do not sell or share personal information as defined under CCPA/CPRA.
- Rights honoured. Access, deletion, correction, opt-out of sharing for cross-context behavioural advertising (we don’t do this anyway), and the right to limit use of sensitive personal information. Routed through privacy@citesvue.com and in-product privacy controls.
- Authorised agents. Supported with verification.
Residency
EU and US processing regions. Single-region pinning on Enterprise.
- Defaults. Region is determined by account origin at sign-up.
- Pinning. Enterprise customers can pin all customer content (raw media, transcripts, evidence layer, embeddings, backups) to a single region. We extend pinning to sub-processor invocations where the provider supports regional routing; sub-processors that cannot honour pinning are documented and can be disabled per BAA/DPA.
- Cross-border instruments. EU SCCs (2021) Module 2 (controller-to-processor) and Module 3 where applicable. UK IDTA addendum where data leaves the UK.
- Government access. No bulk access; we challenge over-broad requests; we notify customers where legally permitted. Full transparency statement in the security pack.
Incident response
Notification within 72 hours of confirmed material breach.
- Definition. A "material breach" is a confirmed unauthorised disclosure, alteration, or loss of customer content or account data — not a contained probing event or unsuccessful attempt.
- SLA. Customer notification within 72 hours of confirmation, in line with GDPR Art. 33; Enterprise contracts may negotiate tighter SLAs.
- Channels. Direct email to workspace owners and security contacts on file; status-page incident with severity tag; in-product banner for severities affecting authenticated sessions.
- Content. Nature of the incident, data categories and approximate volume affected, current containment status, mitigations recommended, and a contact for further questions. A formal post-incident report follows within 30 days.
Security pack
Hand this to your reviewer. Returned inside one business day.
Available under mutual NDA via security@citesvue.com:
- Security overview (architecture, controls, data flows)
- SIG-Lite completed questionnaire (current revision)
- CAIQ-Lite completed questionnaire
- Sub-processor list (current, with regions)
- Most recent annual penetration test executive summary
- DPA (pre-signed) + EU SCCs + UK IDTA
- SOC 2 readiness / trust-gap letter
- Business continuity & DR summary (RPO/RTO)
- Vulnerability management policy summary
- Vendor management policy summary
- Insurance certificate (cyber + E&O)
Levers in your hands
Compliance is shared work. Here’s what you control.
| Lever | Where it lives | Tier |
|---|---|---|
| Per-workspace retention policy | Workspace settings → Retention | Team+ (custom on Enterprise) |
| Region pinning | Workspace settings → Residency | Enterprise |
| SSO + SCIM | Workspace settings → Identity | Enterprise |
| Audit-log export to your SIEM | Workspace settings → Audit | Team+ (continuous on Enterprise) |
| Sub-processor scope (disable specific providers) | Contractual + workspace settings | Enterprise |
| Customer-managed encryption keys (BYOK) | Workspace settings → Encryption | Roadmap — Enterprise pilot |
| Account-level erasure with signed receipt | Account → Delete | All tiers |
| Per-project deletion & age-out | Project settings | Team+ |
AI governance
Where the models sit, and what they’re allowed to do.
- Training-data policy. We do not train, fine-tune, or evaluate any model on customer content. Not our models, not third-party models. Contractually committed in the DPA.
- Provider configuration. Where we use third-party LLM providers for transcription, OCR, artifact extraction, or Q&A, we use zero-retention API modes where the provider offers them, and we contractually prohibit training on inputs in all cases.
- Output grounding. Q&A answers are grounded in the customer’s own evidence layer with cited timestamps, speakers, and frames — not free-form generation. See /product/evidence-qa.
- Human review. Aggregate model-quality metrics are reviewed without engineer access to underlying customer content. Targeted review requires the same just-in-time access workflow as any other customer-content access.
- Safety & misuse. Standard provider-side safety controls remain enabled. We don’t use customer content to red-team models.
Contact
Three routes for security & legal teams.
- Security & questionnaires: security@citesvue.com
- Legal & contracts: legal@citesvue.com
- Vulnerability disclosure: security@citesvue.com
Reviewer FAQ
What we get asked most often during procurement.
The full FAQ continues below in expandable form.