Skip to main content
Skip to main content
FormaOS

Procurement

How a review runs with us: what you receive, who you talk to, and what happens next. Technical answers live in the Security Review FAQ.

Security and technical questions are answered in one place

This page covers how a review runs with us. Every technical answer lives in the documents below, so procurement and security teams are quoting the same wording.

  • Security Review FAQ

    SSO and SCIM, MFA, tenant isolation, encryption, SOC 2 position, hosting, backups, exports, and the capabilities we do not have.

  • Data handling

    Storage, encryption, isolation, audit integrity, retention, and deletion.

  • Service levels

    Availability expectations and support commitments by plan.

  • Incident response

    Detection, containment, severity classification, and disclosure.

How the review process works

What do we receive when a review starts?▾
The Trust Packet: a security overview, architecture and data-handling description, framework control mappings, policy summaries, and the DPA. It is written so your reviewers can start from current material rather than a blank questionnaire.
How long does security review take?▾
It depends on the scope of your questionnaire, your legal process, and the artifacts you request. Sending your questionnaire early, with the sections you consider blocking marked, is the fastest path.
Can we sign a DPA?▾
Yes. A standard Data Processing Agreement covering GDPR and Australian Privacy Act requirements is published in the Trust Center, and a countersigned copy can be requested for your records.
Who do we talk to, and what happens next?▾
Requests go through the contact form with the security review option selected. You get a direct reply, the Trust Packet, and a scoping conversation about frameworks, sites, and the teams involved before anything commercial is proposed.
What can teams usually stand up during early evaluation?▾
Enable a primary framework, map existing evidence to controls, generate a posture snapshot, and review export-ready evidence packages. The pace depends on implementation scope and the quality of the source material you bring.

What teams usually stand up during early evaluation

Initial setup

Enable framework + import existing evidence

Framework mapping

Map controls to evidence + create core policies

Ownership design

Assign owners + set up automation triggers

Posture review

Generate compliance posture report

Buyer review

Review export-ready evidence packages for stakeholders

← Back to Trust CenterOpen enterprise operations proof →Contact for custom security review →