Submitted by Northcrest Software · April 25, 2026 · 38 questions, 38 approved answers.
This packet is the Northcrest Software response to Sterling Financial’s vendor evaluation questionnaire. It consolidates 38 approved answers spanning Cover, Security, Technical, Compliance, and Pricing, plus the supporting exhibits enumerated in the appendix. Every answer has been reviewed by the named function owner and signed off by the executive approver prior to submission. The Order Form, master agreement, and signed exhibits are delivered alongside this PDF under the same submission record.
Manager notes — Submitted 3 weeks ago; client decision arriving — sales rep records win/loss (SCN-004).
Encryption, identity, access control, incident response, and certifications. Each answer below is the approved Northcrest position of record, reviewed by Diego Ortega (security reviewer) against the trust portal documentation and SOC 2 / ISO 27001 evidence on file.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-1900-S01 Security | How is customer data encrypted at rest? | Northcrest answer to "How is customer data encrypted at rest?" — drafted from internal documentation and approved. |
Q-1900-S02 Security | Describe your incident response process. | Northcrest answer to "Describe your incident response process." — drafted from internal documentation and approved. |
Q-1900-S03 Security | Are you SOC 2 Type II certified? | Northcrest answer to "Are you SOC 2 Type II certified?" — drafted from internal documentation and approved. |
Q-1900-S04 Security | Do you support SAML SSO? | Northcrest answer to "Do you support SAML SSO?" — drafted from internal documentation and approved. |
Q-1900-S05 Security | What is your penetration testing cadence? | Northcrest answer to "What is your penetration testing cadence?" — drafted from internal documentation and approved. |
Q-1900-S06 Security | How is MFA enforced for admin actions? | Northcrest answer to "How is MFA enforced for admin actions?" — drafted from internal documentation and approved. |
Q-1900-S07 Security | How are administrative actions logged? | Northcrest answer to "How are administrative actions logged?" — drafted from internal documentation and approved. |
Q-1900-S08 Security | What is your network segmentation model? | Northcrest answer to "What is your network segmentation model?" — drafted from internal documentation and approved. |
Q-1900-S09 Security | Describe your vulnerability disclosure process. | Northcrest answer to "Describe your vulnerability disclosure process." — drafted from internal documentation and approved. |
Q-1900-S10 Security | How are customer encryption keys rotated? | Northcrest answer to "How are customer encryption keys rotated?" — drafted from internal documentation and approved. |
Q-1900-S11 Security | Do you support customer-managed keys? | Northcrest answer to "Do you support customer-managed keys?" — drafted from internal documentation and approved. |
Architecture, integrations, APIs, residency, and operational SLAs. Answers reflect the current production posture as of submission; performance characterizations are from the most recent quarterly load test and are reproducible in customer sandbox environments.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-1900-T12 Technical | Do you support custom fields? | Northcrest answer to "Do you support custom fields?" — drafted from internal documentation and approved. |
Q-1900-T13 Technical | Describe your audit/event stream. | Northcrest answer to "Describe your audit/event stream." — drafted from internal documentation and approved. |
Q-1900-T14 Technical | Do you support Slack notifications? | Northcrest answer to "Do you support Slack notifications?" — drafted from internal documentation and approved. |
Q-1900-T15 Technical | Describe your deployment architecture. | Northcrest answer to "Describe your deployment architecture." — drafted from internal documentation and approved. |
Q-1900-T16 Technical | Do you offer multi-region failover? | Northcrest answer to "Do you offer multi-region failover?" — drafted from internal documentation and approved. |
Q-1900-T17 Technical | What is your published uptime SLA? | Northcrest answer to "What is your published uptime SLA?" — drafted from internal documentation and approved. |
Q-1900-T18 Technical | Do you have a public API? | Northcrest answer to "Do you have a public API?" — drafted from internal documentation and approved. |
Q-1900-T19 Technical | What webhooks are supported? | Northcrest answer to "What webhooks are supported?" — drafted from internal documentation and approved. |
Q-1900-T20 Technical | Do you support Salesforce integration? | Northcrest answer to "Do you support Salesforce integration?" — drafted from internal documentation and approved. |
Q-1900-T21 Technical | What is your data residency story? | Northcrest answer to "What is your data residency story?" — drafted from internal documentation and approved. |
Q-1900-T22 Technical | Describe your API rate limits. | Northcrest answer to "Describe your API rate limits." — drafted from internal documentation and approved. |
Q-1900-T23 Technical | How do you handle large attachments? | Northcrest answer to "How do you handle large attachments?" — drafted from internal documentation and approved. |
Q-1900-T24 Technical | Do you have a sandbox environment? | Northcrest answer to "Do you have a sandbox environment?" — drafted from internal documentation and approved. |
GDPR, HIPAA, residency, retention, sub-processors, and data-subject-request handling. Reviewed by Sarah Kim (legal & compliance) against the Data Processing Agreement, Standard Contractual Clauses, and the published sub-processor list.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-1900-C30 Compliance | Are you CCPA compliant? | Northcrest answer to "Are you CCPA compliant?" — drafted from internal documentation and approved. |
Q-1900-C31 Compliance | Are you GDPR compliant? | Northcrest answer to "Are you GDPR compliant?" — drafted from internal documentation and approved. |
Q-1900-C32 Compliance | Where is customer data stored? | Northcrest answer to "Where is customer data stored?" — drafted from internal documentation and approved. |
Q-1900-C33 Compliance | Do you support EU data residency? | Northcrest answer to "Do you support EU data residency?" — drafted from internal documentation and approved. |
Q-1900-C34 Compliance | Are you HIPAA compliant? | Northcrest answer to "Are you HIPAA compliant?" — drafted from internal documentation and approved. |
Q-1900-C35 Compliance | What is your data retention policy? | Northcrest answer to "What is your data retention policy?" — drafted from internal documentation and approved. |
Q-1900-C36 Compliance | How are sub-processors managed? | Northcrest answer to "How are sub-processors managed?" — drafted from internal documentation and approved. |
Q-1900-C37 Compliance | Do you have a current SOC 2 report? | Northcrest answer to "Do you have a current SOC 2 report?" — drafted from internal documentation and approved. |
Q-1900-C38 Compliance | How do you handle data subject requests? | Northcrest answer to "How do you handle data subject requests?" — drafted from internal documentation and approved. |
Tiers, volume discounts, payment terms, and price-cap protections. Pricing below is the Westfield Health quote position; the formal Order Form supersedes any discrepancies and is signed under the master agreement attached to this packet.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-1900-P25 Pricing | How is your pricing structured? | Northcrest answer to "How is your pricing structured?" — drafted from internal documentation and approved. |
Q-1900-P26 Pricing | Are there volume discounts available? | Northcrest answer to "Are there volume discounts available?" — drafted from internal documentation and approved. |
Q-1900-P27 Pricing | What is included in the Enterprise tier? | Northcrest answer to "What is included in the Enterprise tier?" — drafted from internal documentation and approved. |
Q-1900-P28 Pricing | Are price increases capped at renewal? | Northcrest answer to "Are price increases capped at renewal?" — drafted from internal documentation and approved. |
Q-1900-P29 Pricing | Do you accept purchase orders? | Northcrest answer to "Do you accept purchase orders?" — drafted from internal documentation and approved. |