BR-006Supported
Is customer data encrypted in transit?
The supplied configuration records TLS 1.2 as the minimum and TLS 1.3 enabled.
Source 1 · 19 Jul 2026
Compact engagement · £1,250
A short security questionnaire, answered from the evidence you actually have.
Up to 12 questions and 15 files. You receive a response draft, source references, missing-evidence flags and a short action note.
Price£1,250
Questions≤ 12
Files≤ 15
Use the compact service when the request is already bounded.
- one named SaaS product
- one live buyer or procurement request
- 12 or fewer questions
- 15 or fewer evidence files
- one named factual owner
- no certification or formal control opinion required
FICTIONAL SAMPLE
Response and evidence ledger
Human reviewed
BR-011Partially supported
How is privileged access approved and reviewed?
Roles and alerts are evidenced; one quarterly review record is missing.
Sources 1–2 · Mar–Jul 2026
BR-021Contradictory
Is the subprocessor register current?
The current register and the older customer DPA list different providers.
Sources 1–2 · Jan 2025–Jul 2026
Status is not derived from hit count. Evidence, contradictions and confirmations are adjudicated before release.
You receive five practical records.
- 01completed response draft
- 02source reference for each supported answer
- 03missing-evidence and contradiction flags
- 04customer-confirmation list
- 05short gap and next-action note
Five business days from an accepted inventory.
Qualify
Civitas checks the product, buyer, counts, deadline and sensitivity before payment.
Inventory
The accepted files are listed and tied to the questions.
Draft
Candidate sources and cautious answers are prepared.
Review
A human reviews each released answer; the customer confirms the facts.
Deliver
The response matrix and supporting registers are released together.
The cap is a safety boundary.
If the request exceeds 12 questions, 15 files or one product—or requires contradiction analysis across a wider evidence set—Civitas will re-scope it to the £2,950 Buyer-Ready Security Evidence Review before work begins.
Not included: audit, certification, formal framework assessment, legal advice, penetration testing, policy implementation, operating-effectiveness testing or guaranteed buyer acceptance.