Institutional procurement runs on documents. This is every one a review team will ask us for, with what it is for, who it is for, and where it stands — and six of them require an auditor, an assessor or an insurer rather than us. Those are listed here with the same prominence as the ones that exist.
A procurement pack is the one place where an absent document is more dangerous than an unflattering one. A missing report that is clearly marked missing costs a conversation; a page that quietly omits it costs the relationship the moment a security reviewer asks.
Published here, with its owner, version and review date on the document itself.
It exists and is shared under an engagement or an NDA rather than published openly.
Being written. Ask and we will tell you where it stands and when it is expected.
It does not exist yet. We are not presenting a placeholder as a document.
This cannot be written by us. Its whole value is that an independent auditor, assessor or insurer signed it, and none has. We will not produce our own version.
A review team does not score documents, it scores requirements. These are the requirements a public-sector, donor or INGO assessment works through, with our position on each — including the ones we can only partly answer and the ones that need somebody other than us.
Each state is derived from the documents beneath it, not written. A requirement cannot be marked ready while a document it rests on is missing, and moving one means producing the document rather than editing this page.
Is the supplier a registered legal entity in good standing, and can it prove it?
A certificate of incorporation and a tax clearance certificate.
Closed by: Company registry and revenue authority
Can the supplier show it will still exist at the end of the contract?
Audited financial statements covering the periods your process requires.
Closed by: External auditor
Does the platform actually do what the programme needs, and where does it stop?
How is the platform secured, and who other than the supplier has verified it?
An independent attestation. The controls are described and evidenced internally, and no independent party has tested or certified them.
Closed by: Independent audit firm, security assessor or accredited certification body
What happens to our data, who else processes it, and where?
An executed data processing agreement. Processing is described and every subprocessor is listed; none has signed one.
Closed by: Legal review, then each subprocessor
Does the product meet the accessibility standard our procurement rules impose?
An independently audited conformance report. Ours is measured, automated and manual, and it is our own measurement.
Closed by: Independent accessibility auditor
What is committed when it breaks, and what happens if the supplier disappears?
A written business continuity and disaster recovery plan, including exit and data return.
Closed by: Platform — in preparation
How does this get from a signature to a team using it, and who does what?
How is it priced, how is it bought, and on what terms?
Is there cover behind the liability the contract assigns?
Certificates of professional indemnity and cyber liability cover at the limits your process requires.
Closed by: Insurer
Ordered the way a due-diligence file is assembled: who we are, what the platform is, how it is secured, what happens to your data, how the service runs, how it is bought, and what an independent party would have to confirm.
What VoiceInsights is, what it runs, and for whom — the document a procurement file opens with.
Proof the counterparty is a real, registered entity in good standing.
Held by the business rather than by the platform. Not published here, and not something this repository can or should generate.
Financial standing, for a buyer assessing supplier viability.
Professional indemnity and liability cover, which many institutional contracts require.
What the platform does, end to end, for a reviewer who will not read a demo.
Which research designs run end to end, which run on shared structures, and what each cannot do.
What can be done in a given language, recorded separately for six capabilities and read live from the registry.
What connects today, what is configured per deployment, and which formats are implemented against systems we have never contacted.
Identity, access, tenant isolation, session handling, encryption posture and monitoring.
Every public assurance claim with its verification state, read live. An overdue or unverified claim is never shown as satisfied.
Who else processes customer data, for what, in which entity country, and the state of each data processing agreement.
Ownership, controller and processor roles, consent, retention, deletion, legal hold and transfer.
Where a model is permitted to contribute, where it is not, and what must be true before AI-assisted output is published.
The contractual instrument governing processing on the customer’s behalf.
A template requires legal review before it is offered. We will not publish an unreviewed contract.
The conformance target, what has been measured, how it was measured, and what has not been independently audited.
How support is reached, what response expectations exist, and how incidents are communicated.
Availability posture, backup and recovery state, and what has and has not been rehearsed.
The documented plan, its recovery objectives, and the record of it being exercised.
Backup tooling exists and a restore drill has been run. A HUMAN recovery rehearsal has not been held, so the plan is not yet a document we would stand behind.
How a deployment is scoped, configured, populated and handed over, and how teams are trained.
How VoiceInsights is licensed and bought: annual licence, implementation, usage, and a proposal-and-purchase-order route.
A completed response to the questions institutional due-diligence questionnaires repeat.
Assembled per questionnaire from the registers rather than kept as a static file, because a stale due-diligence answer is worse than none.
Independent attestation of control design and operating effectiveness over a period.
Adversarial testing of the running platform by a party with no stake in the result.
An accredited body attesting that an information security management system meets the standard. No such certificate is held.
Independently audited conformance, as distinct from our own automated and manual measurement.
Each published document above is a page rather than a file, and that is a deliberate choice with a real trade-off.
What you should know
If you have a due-diligence questionnaire, a security assessment template or a vendor form, send it. We answer from the registers rather than from a marketing document, so the answers you get are the same facts these pages carry — including the ones that are inconvenient.