Clear the security review without losing the quarter.

Security review questions

The questions your security team will open with.

Answered here so your reviewer can close half the questionnaire before the first call, and so the review starts from facts rather than from a form. Several of the answers are no, which is the point.

• Where does our data live?

  Inside your own cloud account, whether that is AWS, Azure, or GCP, in your VPC and inside the audit boundary your team already controls. The practical effect on your review is that its scope does not grow: no second copy of your records to protect, no new transfer for your privacy team to paper, and no vendor environment to assess. Your data does not leave your environment to reach us, and the accounts, the network, and the keys stay yours.

• Is IntellaGrow SOC 2 certified?

  No, and no organization is, because SOC 2 produces an attestation report from a licensed CPA firm rather than a certificate. IntellaGrow holds no SOC 2 report today and does not claim one. What the work produces instead is the artifact that costs you real money to be missing: a dated, retrievable population of the actions the system took across the whole observation window, which is what a Type II examination samples. An ungoverned AI deployment cannot hand an auditor that population, and if the record was never written there is nothing to sample and no way to buy it back afterwards.

• Are you HIPAA compliant?

  Compliance is a property of your whole program, assessed by the HHS Office for Civil Rights, and no vendor can self-declare it on your behalf. There is also no such thing as HIPAA certification. What you can hold us to is that a deployment is designed against the technical safeguards at 45 CFR 164.312: access control, audit controls, integrity, authentication, and transmission security. Your privacy officer reviews controls they already recognize rather than learning a new vendor model, and where we act as a business associate, we will execute a Business Associate Agreement before protected health information comes into scope. We hold none today because no engagement has yet required one.

• How do you control what an AI agent can reach?

  Scoping is what caps the cost of an agent being wrong, so each one gets exactly what its task needs and nothing standing. An agent that reads a reporting table has no route into a payments system, because that route was never issued. Where protected health information is involved this is also a regulatory requirement, not just good practice: the HIPAA minimum necessary standard at 45 CFR 164.502(b) limits access to what the purpose actually requires, which is the rule an agent handed a whole record for a three-field task has already broken.

• What gets logged, and would an auditor accept it?

  You get to answer an evidence request without a reconstruction project, because every action is recorded as it happens: what ran, on whose authority, against what data, and what it produced. The record is written before the result is returned to the calling system, so it exists even when the downstream workflow fails. Whether an auditor accepts it is their determination against their own scope and standard, and no vendor can promise that outcome. What we control is that the evidence exists, is dated, is complete for the period, and is retained under your rules in your environment.

• Which frameworks do you build to, and which do you hold?

  You get a direct answer now rather than a gap that surfaces late in diligence, when it costs a review cycle. We design against the HIPAA Security Rule, the AICPA Trust Services Criteria that a SOC 2 examination is conducted against, the NIST AI Risk Management Framework functions of govern, map, measure, and manage, and the ISO/IEC 42001 control structure for AI management systems. We hold no certification, attestation, or authorization against any of them, and we will not imply one. If a specific attestation decides your purchase, ask, and we will tell you exactly where things stand rather than where we would like them to be.

• Who else touches our data?

  Only the parties you approve, and you can see the whole list before you sign. The deployment runs on your cloud accounts and on the model providers you approve, chosen with you during the assessment rather than assumed. The vendors IntellaGrow uses to run its own business, such as hosting, forms, and email, are listed in full on the sub-processors page.

The vendors we use to run our own business