Submitted by Northcrest Software · May 1, 2026 · 26 questions, 26 approved answers.
This packet is the Northcrest Software response to Evergreen Capital Partners’s vendor evaluation questionnaire. It consolidates 26 approved answers spanning Cover, Security, Technical, Compliance, and Pricing, plus the supporting exhibits enumerated in the appendix. Every answer has been reviewed by the named function owner and signed off by the executive approver prior to submission. The Order Form, master agreement, and signed exhibits are delivered alongside this PDF under the same submission record.
Manager notes — Won — multi-year commit with price-cap protection sold it.
Encryption, identity, access control, incident response, and certifications. Each answer below is the approved Northcrest position of record, reviewed by Diego Ortega (security reviewer) against the trust portal documentation and SOC 2 / ISO 27001 evidence on file.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-1920-S01 Security | How is customer data encrypted at rest? | Northcrest answer to "How is customer data encrypted at rest?" — drafted from internal documentation and approved. |
Q-1920-S02 Security | Describe your incident response process. | Northcrest answer to "Describe your incident response process." — drafted from internal documentation and approved. |
Q-1920-S03 Security | Are you SOC 2 Type II certified? | Northcrest answer to "Are you SOC 2 Type II certified?" — drafted from internal documentation and approved. |
Q-1920-S04 Security | Do you support SAML SSO? | Northcrest answer to "Do you support SAML SSO?" — drafted from internal documentation and approved. |
Q-1920-S05 Security | What is your penetration testing cadence? | Northcrest answer to "What is your penetration testing cadence?" — drafted from internal documentation and approved. |
Q-1920-S06 Security | How is MFA enforced for admin actions? | Northcrest answer to "How is MFA enforced for admin actions?" — drafted from internal documentation and approved. |
Q-1920-S07 Security | How are administrative actions logged? | Northcrest answer to "How are administrative actions logged?" — drafted from internal documentation and approved. |
Q-1920-S08 Security | What is your network segmentation model? | Northcrest answer to "What is your network segmentation model?" — drafted from internal documentation and approved. |
Architecture, integrations, APIs, residency, and operational SLAs. Answers reflect the current production posture as of submission; performance characterizations are from the most recent quarterly load test and are reproducible in customer sandbox environments.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-1920-T09 Technical | How do you handle large attachments? | Northcrest answer to "How do you handle large attachments?" — drafted from internal documentation and approved. |
Q-1920-T10 Technical | Do you have a sandbox environment? | Northcrest answer to "Do you have a sandbox environment?" — drafted from internal documentation and approved. |
Q-1920-T11 Technical | What is your release cadence? | Northcrest answer to "What is your release cadence?" — drafted from internal documentation and approved. |
Q-1920-T12 Technical | Do you support custom fields? | Northcrest answer to "Do you support custom fields?" — drafted from internal documentation and approved. |
Q-1920-T13 Technical | Describe your audit/event stream. | Northcrest answer to "Describe your audit/event stream." — drafted from internal documentation and approved. |
Q-1920-T14 Technical | Do you support Slack notifications? | Northcrest answer to "Do you support Slack notifications?" — drafted from internal documentation and approved. |
Q-1920-T15 Technical | Describe your deployment architecture. | Northcrest answer to "Describe your deployment architecture." — drafted from internal documentation and approved. |
Q-1920-T16 Technical | Do you offer multi-region failover? | Northcrest answer to "Do you offer multi-region failover?" — drafted from internal documentation and approved. |
Q-1920-T17 Technical | What is your published uptime SLA? | Northcrest answer to "What is your published uptime SLA?" — drafted from internal documentation and approved. |
GDPR, HIPAA, residency, retention, sub-processors, and data-subject-request handling. Reviewed by Sarah Kim (legal & compliance) against the Data Processing Agreement, Standard Contractual Clauses, and the published sub-processor list.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-1920-C21 Compliance | Are you GDPR compliant? | Northcrest answer to "Are you GDPR compliant?" — drafted from internal documentation and approved. |
Q-1920-C22 Compliance | Where is customer data stored? | Northcrest answer to "Where is customer data stored?" — drafted from internal documentation and approved. |
Q-1920-C23 Compliance | Do you support EU data residency? | Northcrest answer to "Do you support EU data residency?" — drafted from internal documentation and approved. |
Q-1920-C24 Compliance | Are you HIPAA compliant? | Northcrest answer to "Are you HIPAA compliant?" — drafted from internal documentation and approved. |
Q-1920-C25 Compliance | What is your data retention policy? | Northcrest answer to "What is your data retention policy?" — drafted from internal documentation and approved. |
Q-1920-C26 Compliance | How are sub-processors managed? | Northcrest answer to "How are sub-processors managed?" — drafted from internal documentation and approved. |
Tiers, volume discounts, payment terms, and price-cap protections. Pricing below is the Westfield Health quote position; the formal Order Form supersedes any discrepancies and is signed under the master agreement attached to this packet.
| Question | Buyer ask | Approved answer |
|---|---|---|
Q-1920-P18 Pricing | What is included in support pricing? | Northcrest answer to "What is included in support pricing?" — drafted from internal documentation and approved. |
Q-1920-P19 Pricing | How is your pricing structured? | Northcrest answer to "How is your pricing structured?" — drafted from internal documentation and approved. |
Q-1920-P20 Pricing | Are there volume discounts available? | Northcrest answer to "Are there volume discounts available?" — drafted from internal documentation and approved. |