Submitted by Northcrest Software · August 23, 2026 · 42 questions, 42 approved answers.
This packet is the Northcrest Software response to Westfield Health’s vendor evaluation questionnaire. It consolidates 43 approved answers spanning Cover, Security, Technical, Compliance, and Pricing, plus the supporting exhibits enumerated in the appendix. Every answer has been reviewed by the named function owner and signed off by the executive approver prior to submission. The Order Form, master agreement, and signed exhibits are delivered alongside this PDF under the same submission record.
Manager notes — Westfield Health is consolidating their workforce + claims platforms. Marquee RFP, all 42 questions approved, exec sign-off pending.
Encryption, identity, access control, incident response, and certifications. Each answer below is the approved Northcrest position of record, reviewed by Diego Ortega (security reviewer) against the trust portal documentation and SOC 2 / ISO 27001 evidence on file.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-2031-S01 Security | How is customer data encrypted at rest? | All customer data is encrypted at rest using AES-256-GCM via AWS KMS. Encryption keys are managed by AWS KMS with automatic annual rotation; envelope encryption protects data keys. Customer-managed CMKs (BYOK) are available on Enterprise tier and managed through the AWS console with audit trails forwarded to the customer SIEM via CloudTrail. |
Q-2031-S02 Security | How is data encrypted in transit? | TLS 1.3 is enforced on all endpoints; TLS 1.2 is the absolute minimum and only permitted for clients that cannot negotiate 1.3. We use ECDHE key exchange with forward secrecy and modern AEAD cipher suites only. Internal service-to-service traffic uses mTLS with short-lived certificates issued by an internal CA. |
Q-2031-S03 Security | Are you SOC 2 Type II certified? | Yes — SOC 2 Type II covering Security, Availability, Confidentiality, and Privacy trust services criteria. Latest report was issued by an AICPA-accredited firm in Q4 of the most recent year; available under NDA via the trust portal. |
Q-2031-S04 Security | Describe your access control model. | Role-based access control with the principle of least privilege. Standard roles include Viewer, Contributor, Approver, and Workspace Admin. Customers can also define custom roles via API. Permissions are evaluated at request time; every authorization decision is logged with the requesting principal, resource, and decision rationale. |
Q-2031-S05 Security | Do you support SAML SSO? | Yes — SAML 2.0 SSO is supported with Okta, Azure AD/Entra ID, OneLogin, Ping Identity, Auth0, JumpCloud, and any IdP that supports SAML 2.0 SP-initiated and IdP-initiated flows. SCIM 2.0 provisioning automates user lifecycle. |
Q-2031-S06 Security | What is your incident response process? | A documented incident response runbook with severity tiers SEV-1 through SEV-4. SEV-1 customer-impacting incidents trigger paging the on-call within 5 minutes; customers receive status-page updates within 30 minutes and a written post-mortem within 5 business days. |
Q-2031-S07 Security | Are you ISO 27001 certified? | Yes — ISO/IEC 27001:2022 certified by an ANAB-accredited certification body. The certificate, statement of applicability, and current ISMS scope are available on request. |
Q-2031-S08 Security | How is MFA enforced? | MFA is mandatory for all internal accounts (TOTP, FIDO2/WebAuthn). Customer admins can enforce workspace-wide MFA; WebAuthn (Yubikey, Touch ID) is supported alongside TOTP and is required for super-admin actions. |
Q-2031-S09 Security | What is your penetration testing cadence? | Annual third-party penetration test by a CREST-registered firm covering the application, infrastructure, and API. Findings are tracked through remediation and verified in the next test cycle. Executive summary available under NDA. |
Q-2031-S10 Security | How are administrative actions logged? | Every administrative action — user create/update/delete, role change, integration toggle, data export — is written to an immutable audit log with actor, resource, before/after state, and timestamp. Logs are retained for 7 years and streamable to customer SIEM via webhook or AWS Kinesis Data Firehose. |
Q-2031-S11 Security | Do you support customer-managed encryption keys? | Yes — Bring Your Own Key (BYOK) via AWS KMS Customer-Managed CMKs available on Enterprise tier. Key disabling or deletion in your AWS account renders the corresponding customer data permanently inaccessible (cryptographic shredding). |
Q-2031-S12 Security | Describe your network segmentation. | Production VPCs are fully isolated from development and corporate networks. Private subnets host data tier; only a small set of bastion hosts reach the private tier and require MFA + just-in-time access grants. Egress is restricted via VPC endpoints and explicit allow-lists. |
Architecture, integrations, APIs, residency, and operational SLAs. Answers reflect the current production posture as of submission; performance characterizations are from the most recent quarterly load test and are reproducible in customer sandbox environments.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-2031-T01 Technical | Describe your deployment architecture. | A multi-tenant SaaS architecture deployed on AWS across multiple regions. Each customer data set is logically isolated by tenant ID at every storage and query layer; large enterprise customers can opt for dedicated single-tenant deployments on Business+ tiers. |
Q-2031-T02 Technical | Do you offer multi-region failover? | Yes — Enterprise tier includes active-passive multi-region with automated failover. RPO is 1 minute (continuous replication); RTO is 15 minutes for stateless services and 4 hours for the primary database failover. |
Q-2031-T03 Technical | What is your published uptime SLA? | 99.95% monthly uptime for Business tier, 99.99% for Enterprise tier. SLA credits scale with severity and duration; the credit issuance process is fully automated and visible on your billing portal. |
Q-2031-T04 Technical | Do you have a public API? | Yes — a versioned REST API and a GraphQL gateway, both documented with OpenAPI 3.1 and protected by OAuth 2.0 + per-key scopes. Client SDKs available for JavaScript, Python, Go, Java, and .NET. |
Q-2031-T05 Technical | What webhooks are supported? | Webhooks for every primary entity (create/update/delete), every workflow state change, and every audit event. Delivery uses HMAC SHA-256 signatures; failed deliveries retry with exponential backoff for 24 hours then dead-letter. |
Q-2031-T06 Technical | Do you support Salesforce integration? | Yes — native bidirectional Salesforce integration covering Opportunities, Accounts, Contacts, and custom objects. Installed from the AppExchange; field-level mapping is fully configurable per workspace. |
Q-2031-T07 Technical | What is your data residency story? | Data residency in US, EU (Frankfurt, Dublin), UK (London), Canada (Montreal), Australia (Sydney), Singapore. Residency is configurable per workspace at provisioning time and cannot be changed without a migration plan. |
Q-2031-T08 Technical | Describe your API rate limits. | Per-workspace default: 600 requests/minute on the REST API, 60 requests/minute on the write-heavy Bulk API. Limits are configurable on Enterprise tier. Headers expose the current quota, remaining, and reset time on every response. |
Q-2031-T09 Technical | How do you handle large attachments? | Attachments up to 5 GB per file are stored in S3 with server-side encryption. Pre-signed URLs are used for upload/download; virus scanning (ClamAV) runs on upload before the file is marked available. |
Q-2031-T10 Technical | Do you have a sandbox environment? | Yes — every workspace can spin up a sandbox copy of production for testing integrations and changes. Sandbox data is isolated and never touches production. |
Q-2031-T11 Technical | What is your release cadence? | Weekly minor releases (Tuesday morning UTC) and major releases quarterly. Customers can opt into a stable channel that lags by 2 weeks for additional bake time. |
Q-2031-T12 Technical | Do you support custom fields? | Yes — workspaces can define unlimited custom fields with typed validation (string, number, date, picklist, multi-select, currency, lookup). Custom fields are queryable via the API and exposed in reports. |
Q-2031-T13 Technical | Do you have an event/audit stream? | Yes — an append-only audit event stream available via webhook, Kafka, AWS Kinesis Data Firehose, or pull-based API. Events are guaranteed at-least-once delivery with monotonic sequence numbers for dedup. |
Q-2031-T14 Technical | Do you support Slack? | Yes — Slack integration for notifications, slash commands, and approvals. Workspaces can subscribe channels to specific event types; approvers can act directly from Slack. |
Q-2042 Technical | How are integrations scoped and supported for our scale (1500 users)? | Northcrest integrations scale linearly to ~5000 concurrent users per workspace. For 1500 users we recommend the Enterprise tier with the bulk-API connector for Salesforce + the SCIM 2.0 provisioning module. Implementation typically completes in 4-6 weeks. |
GDPR, HIPAA, residency, retention, sub-processors, and data-subject-request handling. Reviewed by Sarah Kim (legal & compliance) against the Data Processing Agreement, Standard Contractual Clauses, and the published sub-processor list.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-2031-C01 Compliance | Are you GDPR compliant? | Yes — GDPR-compliant with a published Data Processing Agreement, EU Standard Contractual Clauses, and a defined Data Subject Request workflow with 30-day fulfillment SLA. EU customer data can be hosted in EU regions (Frankfurt, Dublin) with no cross-border transfer. |
Q-2031-C02 Compliance | Where is data stored? | Customer-selectable at provisioning: US (us-east-1 + us-west-2), EU (eu-central-1 Frankfurt + eu-west-1 Ireland), UK (eu-west-2 London), Canada (ca-central-1 Montreal), Australia (ap-southeast-2 Sydney), Singapore (ap-southeast-1). |
Q-2031-C03 Compliance | Do you support data residency in the EU? | Yes — EU customer workspaces can pin data residency to Frankfurt or Dublin with no cross-border transfer. Replication, backups, and all secondary stores stay within the selected region. |
Q-2031-C04 Compliance | Are you HIPAA compliant? | Yes — Enterprise tier supports HIPAA workloads under a Business Associate Agreement (BAA). PHI is segregated, access-logged, and never used for analytics or model training. |
Q-2031-C05 Compliance | What is your data retention policy? | Customer data is retained for the contract term plus a 30-day grace period for export. After grace, data is permanently deleted within 30 days. Retention overrides for legal hold are available on Enterprise. |
Q-2031-C06 Compliance | How are sub-processors managed? | A current sub-processor list is published at northcrest.io/legal/subprocessors. Changes are notified 30 days in advance. Customers can object to new sub-processors and trigger contract review. |
Q-2031-C07 Compliance | Do you have a SOC 2 report? | Yes — SOC 2 Type II is renewed annually by an AICPA-accredited firm; the most recent report covers a 12-month observation period. Bridge letters are available between reports. |
Q-2031-C08 Compliance | How do you handle data subject requests? | Self-service in-app for access and erasure on all tiers; admin-mediated for portability and rectification. Standard fulfillment SLA: 30 days. Audit trail on every fulfillment. |
Q-2031-C09 Compliance | Schrems II — Standard Contractual Clauses? | Yes — current EU SCCs (2021 versions) are signed as part of the DPA. Transfer Impact Assessments performed for any data transfers outside the EEA / UK / adequacy regions. |
Q-2031-C10 Compliance | Are you CCPA compliant? | Yes — CCPA / CPRA compliant. We do not sell personal information. Consumer rights requests are handled through the same DSR workflow as GDPR. |
Tiers, volume discounts, payment terms, and price-cap protections. Pricing below is the Westfield Health quote position; the formal Order Form supersedes any discrepancies and is signed under the master agreement attached to this packet.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-2031-P01 Pricing | How is your pricing structured? | Tiered subscriptions: Starter (per-seat monthly), Business (per-seat annual + included usage), Enterprise (custom contracted with volume discount + dedicated success). Quotes are valid for 60 days; multi-year commitments available with 10-15% discount. |
Q-2031-P02 Pricing | Are there volume discounts? | Yes — tiered volume discount on Business and Enterprise: 100+ seats 8%, 250+ seats 14%, 500+ seats 20%, 1000+ seats negotiated. Stacking with multi-year commit available. |
Q-2031-P03 Pricing | What is included in the Enterprise tier? | Enterprise includes everything in Business plus dedicated CSM, named technical account manager, 24/7 priority support, custom contractual SLA, BYOK encryption, single-tenant deployment option, embedded SDKs, audit log streaming, and quarterly business reviews. |
Q-2031-P04 Pricing | Are price increases capped at renewal? | Yes — annual price increases at renewal are capped at the lesser of 7% or CPI-U + 2% on multi-year contracts. Single-year contracts are subject to current list price at renewal. |
Q-2031-P05 Pricing | Do you accept purchase orders? | Yes — POs are accepted for invoiced annual contracts. Required PO fields are documented in the Order Form. |
Q-2031-P06 Pricing | What is included in support pricing? | Standard business-hours email support is included on all tiers. Premium 24/7 with named contacts and 1-hour SEV-1 response is included on Enterprise; available as an add-on on Business. |