VOL IV · Nº 207FRIDAY · MAY 15 · 20261 FLAG OPEN

· RFPs· Questions· Library· Reviewers· AuditActing as · Nina Vega

RFP · Northwind Logistics

RFP-2040 — Northwind logistics ops modernization

40 of 42 approved. 2 outstanding — packet generation guard fires (SCN-EDGE-004).

Export security CSV

Status

In progress

Manager Marcus Sterling

Questions approved

40 / 42

2 still need approval

Due

Jun 13, 2026

overdue 71 days

Account

Northwind Logistics

Northwind transport ops modernization

AI drafting + library reuse

On import, the proposal manager clicked "AI draft answers". 32 of 42 questions matched library entries verbatim or with minor edits; 10 were assigned to human authors. Each AI draft emits an ai_draft_created audit row.

Drafted

From library

Human authored

Reviewer chain

SE → security → legal → exec

Packet generation blocked — 2 questions still need approval

All questions must be approved before the packet ships. Outstanding questions:

Q-2040-C41 — Are you GDPR compliant? (In Review)
Q-2040-C42 — Where is customer data stored? (In Review)

Questions (42)

Grouped by category. Click a code to open the question detail.

Security · 12 questions

Q-2040-S01How is customer data encrypted at rest?Approved
Q-2040-S02Describe your incident response process.Approved
Q-2040-S03Are you SOC 2 Type II certified?Approved
Q-2040-S04Do you support SAML SSO?Approved
Q-2040-S05What is your penetration testing cadence?Approved
Q-2040-S06How is MFA enforced for admin actions?Approved
Q-2040-S07How are administrative actions logged?Approved
Q-2040-S08What is your network segmentation model?Approved
Q-2040-S09Describe your vulnerability disclosure process.Approved
Q-2040-S10How are customer encryption keys rotated?Approved
Q-2040-S11Do you support customer-managed keys?Approved
Q-2040-S12What is your bug bounty policy?Approved

Technical · 14 questions

Q-2040-T13Describe your audit/event stream.Approved
Q-2040-T14Do you support Slack notifications?Approved
Q-2040-T15Describe your deployment architecture.Approved
Q-2040-T16Do you offer multi-region failover?Approved
Q-2040-T17What is your published uptime SLA?Approved
Q-2040-T18Do you have a public API?Approved
Q-2040-T19What webhooks are supported?Approved
Q-2040-T20Do you support Salesforce integration?Approved
Q-2040-T21What is your data residency story?Approved
Q-2040-T22Describe your API rate limits.Approved
Q-2040-T23How do you handle large attachments?Approved
Q-2040-T24Do you have a sandbox environment?Approved
Q-2040-T25What is your release cadence?Approved
Q-2040-T26Do you support custom fields?Approved

Pricing · 6 questions

Q-2040-P27What is included in the Enterprise tier?Approved
Q-2040-P28Are price increases capped at renewal?Approved
Q-2040-P29Do you accept purchase orders?Approved
Q-2040-P30What is included in support pricing?Approved
Q-2040-P31How is your pricing structured?Approved
Q-2040-P32Are there volume discounts available?Approved

Compliance · 10 questions

Q-2040-C33Do you support EU data residency?Approved
Q-2040-C34Are you HIPAA compliant?Approved
Q-2040-C35What is your data retention policy?Approved
Q-2040-C36How are sub-processors managed?Approved
Q-2040-C37Do you have a current SOC 2 report?Approved
Q-2040-C38How do you handle data subject requests?Approved
Q-2040-C39Schrems II — Standard Contractual Clauses in place?Approved
Q-2040-C40Are you CCPA compliant?Approved
Q-2040-C41Are you GDPR compliant?In Review
Q-2040-C42Where is customer data stored?In Review

Acting as Nina Vega · VP salesswitch role →