Movahedi Solutions
Reviewer's Guide
1000823315 ONTARIO INC., operating as Movahedi Solutions, Mississauga, Ontario, Canada. Contact: mohammad@movahedi.ca. This one-page guide tells a reviewer where to find each answer, with section and page references. Start here, then follow the links. Each linked document is labelled as what it is: a questionnaire answer set, a self-assessment, or a header scan result.
In five minutes
- Read the Trust Center hero and the Start your security review card for the plain answer and the contact route.
- Read the Security Questionnaire Answers, 12 questions, for the short answers buyers ask most often.
- Open the Vendor Security Questionnaire, 60 questions in 12 categories, for the full answer set.
Where to find each answer
| Question | Find it in | Section |
|---|---|---|
| Who is the company, and what does it do? | Vendor Security Questionnaire | Category A, A1 to A5; also Capability Statement |
| How is client data handled? | Vendor Security Questionnaire | Category B, B1 to B5; also Privacy and Data Handling |
| Who can access client material? | Vendor Security Questionnaire | Category C, C1 to C5 |
| How is the public site built and delivered? | Vendor Security Questionnaire | Category D, D1; also Security Practices: Public site architecture |
| How is the website protected, and what is the header scan evidence? | Vendor Security Questionnaire | Category E, E1 to E3; scan link and date in Security Practices: Header scan result |
| How are changes, vulnerabilities, and backups handled? | Vendor Security Questionnaire | Category F, F1 to F5; also How work is planned, checked, and improved |
| How are incidents handled? | Vendor Security Questionnaire | Category G, G1 to G5; also Responsible Disclosure |
| What certifications, insurance, or clearance apply? | Vendor Security Questionnaire | Category H, H1 to H5; also Certificates |
| What privacy and regulation work is offered? | Vendor Security Questionnaire | Category I, I1 to I5; also Privacy Self-Assessment |
| Which third parties are involved? | Vendor Security Questionnaire | Category J, J1 to J5; also Subprocessors |
| What availability is offered? | Vendor Security Questionnaire | Category K, K1 to K5 |
| What people, physical, and contract terms apply? | Vendor Security Questionnaire | Category L, L1 to L5; also Terms of Engagement |
| AI governance, in plain language | AI Governance Self-Assessment | Govern, Map, Measure, Manage |
| Cybersecurity, in framework order | Cybersecurity Self-Assessment | Govern, Identify, Protect, Detect, Respond, Recover |
| Website accessibility and privacy | Website Accessibility and Privacy Self-Check | Sections 1 to 7, live site check, October 28, 2026 |
Checked references, by topic
These references were checked against the actual documents before publish. They do not change any claim in the documents they point to.
| Topic | Checked reference |
|---|---|
| Encryption and header scan | VSQ E1 to E3 and D3; NIST CSF Cybersecurity Self-Assessment sections 5 and 9; Security Practices. Header scan is for the public site only; see Security Practices for the dated result. No encryption standard for client data is claimed (VSQ D3, confirmed in writing per engagement). |
| Incident and disclosure | VSQ G2; NIST CSF Cybersecurity Self-Assessment sections 6 and 7; Responsible Disclosure; Privacy Self-Assessment section 4.5, breach notification. |
| Data handling | VSQ B1 to B5 and I5; NIST CSF Cybersecurity Self-Assessment sections 2 and 5; Privacy Self-Assessment sections 5 and 6. |
| Company and services | VSQ A1 to A3; Capability Statement. |
| Stack and third parties | VSQ J1 and D1; Subprocessors. Cloud and hosting questions also go to CAIQ-Lite Self-Assessment domains 1, 4, 11, and 15, and to VSQ Categories D and E. |
| Credentials | VSQ H4, founder personal credentials only; Certificates. |
Header scan evidence, where to find it
The dated header scan result lives in one place: Security Practices. It is a header scan, not a penetration test.
Encryption: what to look for, and what is stated
For the public site, delivery over HTTPS through Cloudflare is stated, with the dated header scan above. For client data, an encryption standard is not stated generally on this site. Where a client requires a specific provision on encryption, that provision is confirmed in writing for the engagement before work starts, under the Terms of Engagement. A reviewer who needs an encryption provision for a specific engagement should raise it during scoping, or request a tailored response at mohammad@movahedi.ca naming the questionnaire and the deadline.
Next step
For anything not found through this guide, use the Document Request page, or contact mohammad@movahedi.ca naming the document or questionnaire and the deadline. No response time is promised on this page.
Related pages
Scope and limits, stated briefly
This guide is company information. It is a guide to documents that exist. It is not a guide to a report that does not exist, and no such report is listed here. Contact: mohammad@movahedi.ca.