BR-006Supported
Is customer data encrypted in transit?
The supplied configuration records TLS 1.2 as the minimum and TLS 1.3 enabled.
Source 1 · 19 Jul 2026
Core engagement · £2,950
Turn scattered security and AI material into one buyer-ready evidence record.
For one product, up to 30 questions and 30 files. Civitas inventories the sources, drafts cautious answers, records contradictions and gaps, and prepares the pack for customer confirmation.
Price£2,950
Questions≤ 30
Files≤ 30
The accepted boundary
Preparation only. The customer remains responsible for factual accuracy, commitments and final submission.
- Product
- One B2B SaaS product or bounded production service
- Buyer request
- Up to 30 security, AI/vendor, model, data-flow or governance questions
- Evidence
- Up to 30 accepted files after inventory
- People
- One named factual owner and one 45-minute clarification/findings call
- Timing
- Seven business days from accepted evidence inventory and payment
- Revision
- One bounded factual-correction pass
The delivery is a working evidence pack.
- 01Executive readiness note
- 02Completed buyer-questionnaire response draft
- 03Source evidence register
- 04Security evidence map
- 05Gap, owner and action register
- 06Contradiction and customer-assertion register
- 07AI/model/vendor/data-flow appendix where relevant
- 08Method and limitations
- 09Integrity appendix
- 10Customer confirmation and release checklist
FICTIONAL SAMPLE
Response and evidence ledger
Human reviewed
BR-011Partially supported
How is privileged access approved and reviewed?
Roles and alerts are evidenced; one quarterly review record is missing.
Sources 1–2 · Mar–Jul 2026
BR-021Contradictory
Is the subprocessor register current?
The current register and the older customer DPA list different providers.
Sources 1–2 · Jan 2025–Jul 2026
BR-028Unsupported
Are customer-facing security claims supported?
Several claims are broader than the available evidence. A positive answer is not supportable.
Sources 1–2 · 20 Jul 2026
Status is not derived from hit count. Evidence, contradictions and confirmations are adjudicated before release.
Retrieval is automated. Judgment is not hidden.
01
Scope
The product, buyer request, evidence limit and authority are agreed before transfer.
02
Inventory
Accepted files are inventoried, hashed and kept tied to their identity, date and owner.
03
Candidate mapping
Local tools and approved model assistance propose relevant sources. Suggestions remain provisional.
04
Human review
A named human reviews every material status, answer and contradiction before release.
05
Customer confirmation
The customer confirms factual assertions and final external use.
06
Release
The customer-safe pack is checked for internal leakage, prohibited claims and archive integrity.
FICTIONAL REVIEW CASE · DEMONSTRATION
Contradiction register
Source A · DEMO-SRC-007
Access Control Standard
“MFA is required for all privileged access.”
Source B · DEMO-SRC-019
Legacy Service Exception Register
“Legacy administrative service remains exempt from MFA.”
CONTRADICTION
Owner confirmation required before release
Reviewer note
Confirm whether the exception remains active. If active, qualify the questionnaire response and record the remediation owner and date.
What this service is not
- an audit or audit opinion
- certification or compliance attestation
- independent assurance
- legal or regulatory advice
- penetration testing
- operating-effectiveness testing
- a guarantee that the buyer will accept the answer
Evidence transfer is agreed after qualification.
Do not send confidential evidence with the first enquiry. Civitas first confirms scope, sensitivity, transfer route, model boundary, retention and deletion. External model processing requires written approval.
Start with a non-sensitive outline.
Send the product, buyer deadline, question count, file count and a short sensitivity summary. Civitas confirms fit in writing before evidence or payment is accepted.
Request scope confirmation