Security and Due-Diligence Questionnaire

Version 1.0 - Effective 2026-07-08 - Change log

Template document: review by a qualified data-protection lawyer or DPO before commercial reliance. Not legal advice.

Pre-answered responses to the questions law firms most often ask when vetting a technology vendor. This document is written for a firm's ethics and procurement review: where relevant, answers are mapped to ABA Model Rules 1.1 (competence), 1.6 (confidentiality), and 5.3 (supervision of non-lawyer assistance), ABA Formal Opinion 512 on generative AI, and SRA expectations on vendor due diligence. Answers are deliberately honest about company size and maturity; we believe accurate answers from a small vendor beat vague answers from anyone. If your questionnaire asks something not covered here, email [email protected] and we will answer in writing.

Organisation and people

Q1. Who is Amaigo? Amaigo builds Whistle, an embeddable AI intake assistant for law firms and professional-services businesses. We act as a processor for our clients' prospective-client data under our DPA.

Q2. How large is the company? Amaigo is currently solo-operated by its founder. There are no other staff with access to systems or data. We state this plainly because it changes the shape of several answers below: access control is simpler, and separation-of-duties controls are compensated for by automation and audit logging.

Q3. What is the background of the principal? The founder works professionally in cybersecurity governance, risk, and compliance, and applies that discipline to Amaigo's controls. Further detail is available on request.

Q4. Is multi-factor authentication used? Yes. MFA is enabled on every account with access to production systems, source control, DNS, and provider dashboards.

Q5. How are credentials managed? Via a password manager with unique, generated credentials per service. No credential reuse.

Q6. Are personnel bound by confidentiality? Yes. The principal is bound by the confidentiality commitments in the Terms of Service and DPA; any future staff or contractors will sign confidentiality agreements before any data access (relevant to Model Rule 5.3 supervision).

Q7. Are background checks performed? With one principal, this question reduces to Q3. Any future hires with data access will be screened before access is granted.

Infrastructure and hosting

Q8. Where is our data hosted? Application server and PostgreSQL database on Railway in Amsterdam; website and serverless functions on Vercel in Frankfurt (fra1); booking via Cal.com in the EU; transactional email via Resend/Postmark EU regions; Cloudflare provides DNS, WAF, and bot mitigation at the edge without storing personal data.

Q9. Is personal data stored outside the EU? No. Personal data is stored in the EU only. Redacted free text is processed (not stored as customer data) by Anthropic in the US; see the AI section and the Transfer Risk Assessment.

Q10. Do you operate your own data centres? No. We use managed platforms (Railway, Vercel) and inherit their physical and infrastructure security.

Encryption

Q11. Is data encrypted in transit? Yes, TLS on all connections, including service-to-provider connections.

Q12. Is data encrypted at rest? Yes, via the managed PostgreSQL database's encryption at rest.

Key and secret management

Q13. Where are secrets stored? In environment-scoped configuration on Railway and Vercel only. Never in source code, never in the widget bundle, never in the browser.

Q14. Can the widget leak credentials? No. The widget receives a filtered public configuration containing no secrets, no internal criteria, and no alert email addresses.

Q15. Are secrets rotated? Yes, on personnel changes and on any suspected exposure or incident. CI secret scanning guards against accidental commits.

Q16. Do you support customer-managed encryption keys? Not yet. This is on the roadmap; today, keys are managed by our infrastructure providers.

Access control

Q17. Who can access our data? Only the principal, via least-privilege credentials, and only where needed to operate the service or fulfil your instructions.

Q18. How are admin functions protected? Admin endpoints (export, erasure, metrics) require a server-side bearer token and are not reachable from the widget or public site.

Q19. Can one client access another client's data? No. Every query is scoped by client id, tenant identifiers are validated on input, and there are no cross-tenant access paths. See the Security Overview.

Q20. Is there a joiners/movers/leavers process? With one principal it is not currently exercised, but the documented process is: access granted on least privilege, reviewed on role change, revoked and secrets rotated on departure.

AI and data usage

Q21. Which AI provider do you use? Anthropic (Claude), under commercial API terms. See the AI Transparency Notice.

Q22. Is our data used to train AI models? No. Your data is never used to train models. Anthropic's commercial terms exclude training on customer content.

Q23. How long does the AI provider retain data? A short, bounded period for trust and safety purposes under Anthropic's commercial terms. A zero-data-retention arrangement is on our roadmap; we will update this document and notify clients when it is in place. Until then we describe retention honestly as short and bounded, not zero.

Q24. What data does the AI actually see? Free-text messages only, after automated redaction of emails, phone numbers, and long digit runs. Contact details are captured through structured form fields that never pass through the AI.

Q25. Are conversation transcripts stored? Not by default. Transcript storage is off unless a client explicitly enables it, and retention then follows the configured retention period.

Q26. Does the AI make decisions about individuals? No solely automated decisions with legal or similarly significant effects. The assistant qualifies, books, or routes to a human; it never automatically rejects a prospective client. See the AI Transparency Notice and AUP.

Q27. How does this map to ABA Formal Opinion 512? Opinion 512 requires lawyers to understand a tool's data handling before use (Rules 1.1 and 1.6). Q21-Q26, the AI Transparency Notice, and the DPA are written to give you that understanding in one review pass, with vendor terms you can cite in your own file (Rule 5.3 due diligence). The same answers serve SRA expectations that firms know where data is processed and have a DPA in place with any AI provider.

Logging and monitoring

Q28. What do your logs contain? Operational events only. No chat content is ever written to server logs.

Q29. Do you keep an audit trail? Yes, an append-only audit log of compliance-relevant events (consent recorded, exports, erasures, purges). It contains no personal data.

Q30. Is there monitoring and alerting? Yes, platform monitoring and alerts via Railway, Vercel, and Cloudflare, feeding the detection step of our Breach Response Procedure.

Data lifecycle

Q31. How long is data retained? Default 365 days, configurable per client. Firms handling sensitive intake often configure shorter periods; see the Retention Schedule.

Q32. Is deletion automated? Yes. An automated purge enforces the configured retention period.

Q33. How do you support data-subject rights? Export and erasure endpoints support DSARs; see the DSAR Procedure. Erasure requests override retention settings.

Q34. What happens to our data on termination? Deletion within 30 days of termination, with confirmation, per the DPA.

Backups and disaster recovery

Q35. Are backups taken? Yes, managed backups via the database provider, encrypted and held in the EU.

Q36. What are your RPO and RTO? Our working targets are recovery point within 24 hours and recovery within one business day. These are honest targets based on provider capabilities, not independently certified figures, and we will formalise them as the platform matures. Restores are performed from managed provider backups to a fresh instance.

Secure development

Q37. How is code kept secure? Dependency scanning, CI secret scanning, Zod input validation on every endpoint, parameterised database access, and a security review before each release. See the Security Overview.

Sub-processors

Q38. Do you publish a sub-processor list? Yes: Sub-processors, with entity, location, function, and transfer mechanism per row. We give 30 days' advance notice of changes (notification policy) and you have a right to object on reasonable data-protection grounds.

Incident response

Q39. How quickly are we told about a breach? As processor we notify affected controllers without undue delay and in any event within 48 hours of becoming aware, with the content your own 72-hour regulator notification needs. Full runbook: Breach Response Procedure.

Insurance and certifications

Q40. Do you hold SOC 2, ISO 27001, or Cyber Essentials? Not yet. All three are on the roadmap as the platform matures, and we know many legal-industry reviewers treat SOC 2 as the floor. This questionnaire and the Security Overview exist to answer due diligence substantively in the meantime.

Q41. Do you carry cyber insurance? Status available on request at [email protected].

Legal

Q42. Is a DPA available? Yes, and it is auto-incorporated into the Terms of Service; a signable copy is available on request. See the DPA.

Q43. What is the transfer mechanism for the US AI provider? Layered safeguards with EU SCCs and the UK Addendum as fallback, supported by a maintained Transfer Risk Assessment reviewed annually and on trigger events.

This document is a GDPR-aligned template and must be reviewed by a qualified data-protection lawyer or DPO before commercial reliance. It is not legal advice.