Enterprise / Document readiness
Contracts and security documentation, with explicit approval boundaries.
We maintain a starter set of draft commercial and security documents for review and project-specific completion. Drafts are not signed contracts, adopted company policies, proof of employee compliance, or third-party certifications.
Documentation available for review and completion
Before any agreement becomes binding, the contracting entities, legal jurisdiction, insurance, specific personnel, client privacy obligations, actual security controls and commercial terms must be verified. No private source code, tax IDs, banking details or controlled customer information should be sent through the public inquiry form.
Nondisclosure agreement (NDA)
Protects nonpublic business, architecture, source, customer or security information exchanged while evaluating a project.
Draft starter template; requires legal review and signatures
Master services agreement (MSA)
Sets the negotiated baseline for commercial duties, intellectual property, liability, indemnities, confidentiality and termination.
Draft starter template; no active negotiated terms implied
Statement of work (SOW)
Identifies the exact deliverables, systems, engineering team, costs, milestones, validation, exclusions and approved access.
Draft scope template; completed and signed per client
Data processing addendum (DPA)
Defines processing purpose, data roles, permitted providers, security duties, data subject requests, retention and deletion.
Draft addendum; client data flows and applicable law require review
Employee and contractor confidentiality/IP terms
Clarifies worker-level confidentiality, approved access, assignment of qualifying work products and offboarding requirements.
Draft addendum; individual status, contracts and compliance unverified
Information security policy
Proposed standards for identity, devices, code changes, secrets, customer data, contractor access and security exceptions.
Draft control baseline; implementation and workforce acknowledgement not certified
Data retention and deletion schedule
A proposed inventory of records, providers, owners, approved retention decisions, deletion and legal holds.
Draft inventory; actual provider periods and operational deletion need validation
Incident response plan
Proposed incident reporting, investigation, evidence preservation, containment, recovery and notification coordination.
Draft response plan; no exercised response SLA or 24/7 SOC implied
Vendor security questionnaire
A worksheet mapping procurement questions to current evidence, unknown controls, responsibilities and remediation.
Draft questionnaire; answers not independently attested or approved
What comes before a signature?
Actual business identity and signatory authority, counsel-reviewed language, the agreed project scope, documented employee/contractor confidentiality and IP obligations, a truthful security control inventory, and approved ways to share restricted information. Government or defense contracting has additional program-specific restrictions.
Internal legal and security starter documents are maintained in the private source repository under docs/legal-templates and docs/security-templates. They are not publicly downloadable signed agreements or evidence of adopted procedures. For general planning, the Client Document Center provides an editable, explicitly non-binding SOW starter package.