Procurement & Compliance
Procurement & Compliance FAQ
The questions enterprise procurement, vendor-risk, and compliance reviewers ask before signing — answered directly. The answers here are identical to those in our security review pack and on a call; consistency across channels is the point.
For a security questionnaire (SIG / CAIQ / VSA), the DPA, or source/architecture review under NDA, contact us or email [email protected].
Company & product
What does Tricognita do?
Multi-tenant cloud security posture management (CSPM) with AI-assisted remediation across AWS, Azure, and GCP: asset inventory, security findings, compliance scoring, attack-path analysis, and an autonomous-but-supervised remediation engine (ARIA) for known-good fixes. AI is never on the pass/fail verdict path.
Where do you run?
Application / BFF on Vercel; Go API on Fly.io (region configurable, Asia-Pacific default); Neon Postgres; Upstash Redis. Your raw cloud resources stay in your own account — the control plane reads them in place and does not warehouse your customer data. The posture findings and tamper-evident audit chain the platform produces are stored in the control plane (Neon Postgres) in your selected region.
How do our cloud credentials reach you?
You grant cross-account access to a Tricognita role, assumed via AWS STS with a mandatory per-tenant ExternalId. The platform never receives or stores long-lived customer cloud credentials. Azure and GCP use the equivalent federated Service-Principal / Workload-Identity pattern.
Compliance status (stated honestly)
Do you have SOC 2?
Type II is in progress with an external auditor; the completion timeline is shared under NDA. Type I evidence is available on request.
ISO 27001 / HIPAA / PCI / FedRAMP?
ISO 27001: not yet certified; many underlying controls are documented. HIPAA / PCI: not in scope — the platform does not process PHI or cardholder data. FedRAMP: not currently planned. We will not claim a certification we do not hold.
Encryption?
At rest: AES-256 across Postgres, Redis, and S3 archives; customer cloud credentials are KMS envelope-encrypted at the application layer. In transit: TLS 1.2+ everywhere with HSTS preload. Customer-managed KMS (BYOK) is on the roadmap, not today.
Security & access
Who has access to customer data inside Tricognita?
Production access is restricted and audit-logged; support access is read-only through an internal admin tier with time-limited, audit-logged impersonation — no silent impersonation. Sub-processors do not receive plaintext customer data.
Tenant isolation?
Every customer-data row carries a tenant id that is part of the signed session, the JIT token minted for upstream calls, and every database query. Cross-tenant requests are rejected, not merely hidden. Details on the Architecture and Trust pages.
Auditability?
Every state-changing action is recorded in an append-only, SHA-256 hash-linked audit log. Tampering with a row breaks every downstream hash. Customers can export their full audit trail at any time.
Operations & exit
Support and incident response?
Founding-team support during business hours (IST). Customer-reported incidents are acknowledged the same business day, with status updates until resolution and a post-incident report afterward. A formal 24/7 SLA is on the roadmap — see the Status page for current commitments.
RTO / RPO and backups?
Vercel rollback under ~1 minute; Fly rollback under ~2 minutes; Neon point-in-time recovery within plan retention with continuous replication (~seconds RPO). S3 archives are versioned; audit logs are never deleted from production.
What happens to our data when we leave?
Cancellation triggers a 30-day grace period. On end-of-grace, customer-data rows are deleted from all tables and Redis keys are purged by tenant pattern. Audit logs are retained for the regulatory window in the agreement (typically 7 years). A deletion certificate is provided on request.