Due-Diligence Package

Package contents

1. Capability Statement, October 27, 2026: who the company is, its seven services, and how engagements are agreed.
2. Privacy Notice for Engagements, October 27, 2026: how client material is used, who can access it, and what happens at engagement end.
3. Terms of Engagement, October 27, 2026: scope, rate, term, payment, controls, handover, and how specific requirements are confirmed in writing.
4. Vendor Security Questionnaire, October 27-28, 2026: 60 questions in 12 categories. This filled self-assessment serves as the CAIQ-style and SIG-style filled self-assessment for this package. No separate spreadsheet is claimed for this package.
5. Security Questionnaire Answers, October 27, 2026: 12 pre-filled answers for the questions buyers ask most often.
6. Privacy Self-Assessment, October 27, 2026: 8 main sections, 18 subsections, 26 headed sections, PIPEDA principles and Law 25 topics.
7. AI Governance Self-Assessment, October 27, 2026: 8 main sections, NIST AI Risk Management Framework Govern, Map, Measure, Manage.
8. Cybersecurity Self-Assessment, October 28, 2026: 9 main sections, NIST Cybersecurity Framework Govern, Identify, Protect, Detect, Respond, Recover.
9. Website Accessibility and Privacy Self-Check, October 28, 2026: 7 main sections, live site check on October 28, 2026.
10. CAIQ-Lite Self-Assessment, October 28, 2026: 16 control domains, 32 questions, labelled as a self-assessment, not a CSA assessment or certification.
11. NIST CSF Matrix Self-Assessment, October 28, 2026: 18 rows across 6 functions, concise matrix of the same assessment as the narrative cybersecurity self-assessment.
12. CIS Controls v8 and MVSP Alignment, October 28, 2026: 16 verified alignment items, 10 CIS controls at control level and 6 MVSP items.
13. DNS and SSL Checks, October 28, 2026: SPF, DKIM, DMARC, mail routing, SSL Labs grade A.
14. Encryption Statement, October 28, 2026: public site facts and engagement provisions, split in two.
15. Vulnerability Disclosure Policy, October 27, 2026: formal disclosure policy, with disclosure acknowledgements inside.
16. Data Processing Addendum Summary, October 27, 2026: summary only, not a signed addendum.
17. Security Practices, October 27, 2026: how the public site is protected, how client information is handled, and how to report a security issue.
18. Privacy and Data Handling, October 27, 2026: data collected and not collected, use, access, and end-of-engagement handling.
19. Responsible Disclosure, October 27, 2026: scope, report contents, handling steps, acknowledgement, and re-check process.
20. Certificates, October 27, 2026: founder personal credentials.
21. Third Parties, October 27, 2026: listings and scan, each its own dated entry.
22. Website Privacy Policy, last updated October 29, 2026.
23. Header scan result, October 28, 2026: see Security Practices.

Document vault: public items, and on-request items

Public items are linked directly: Capability Statement, Privacy Notice for Engagements, Terms of Engagement, Document Request Procedure, and the Document Request form, all on the Documents page and the Document Request page. On-request items are available through the Document Request Procedure and form, in the current version at the time of the reply: the Vendor Security Questionnaire, the CAIQ-Lite self-assessment, and the NIST CSF matrix self-assessment, each as a document version for a procurement. The web pages for those assessments remain readable on this site, as linked in the package contents above; the vault route is the route for a requested document version. The dated header scan link is included in the package contents above. A document not listed in this package is not offered through the package.

Control status, as of the dates shown

Dated, checkable status, not a claim of continuous live scanning:

Status above is as of the dates shown. A later check may differ, and a re-check updates the date. No continuous monitoring claim is made on this page.

How to use this package, in general terms

A reviewer reads the capability statement and terms first, then the questionnaire answers, then the self-assessment for their topic, then the registrations and third-party entries for the check they need. Anything not in the package is requested through the route below.

Request what is not in the package

Use the Document Request page, or contact mohammad@movahedi.ca naming the document and the deadline. Public items are linked directly. On-request items are sent in their current version, with their date, where they exist. Where access requires an agreement, the requirement and the route are stated in the reply. If a document does not exist, that is said directly in the reply, with a related document offered where one covers the subject. No automated click-through NDA system is claimed, and no legal wait period is claimed on this page. The route is: ask at mohammad@movahedi.ca.

Related pages

• Trust Center
• Reviewer's Guide
• Documents
• Document Request

Scope and limits, stated briefly

Each self-assessment in the package is labelled as a self-assessment, not a certification, audit, or third-party verification. Contact: mohammad@movahedi.ca.