# Clavenar Procurement Response

Version 1.0.0 · public standard response

This document supplies a truthful reusable starting point. The executed Order
Form and scoped evidence control a customer-specific response. “Not claimed”
means no public assurance should be inferred.

## Company and product

| Question | Standard response |
|---|---|
| Contracting entity | Vanteguard Labs LLC |
| Product | Clavenar, a governance and evidence control plane for AI-agent actions |
| Primary contact | contact@clavenar.com |
| Security reporting | Published coordinated disclosure policy and security.txt |
| Production approval | Requires executed MSA/Order Form, DPA as applicable, security/data schedule, secure-exchange details, exact release, and go-live evidence |
| Public demo | Evaluation only; no production work, credentials, personal data, regulated data, or real financial actions |

## Security and privacy

| Topic | Standard response |
|---|---|
| Authentication and authorization | Distinct workload/user identities, least-privilege capabilities, tenant-bound authorization, policy and approval gates |
| Encryption | TLS/mTLS in transit; authenticated encryption for governed sensitive payloads; X25519/HKDF/AES-256-GCM customer exchange |
| Tenant isolation | Typed tenant identity through supported routes, state, approval, evidence, retention, and deletion |
| Secure development/release | Protected immutable release graph with exact source, SBOM, provenance, signatures, external install checks, and transactional promotion |
| Vulnerability management | Governed disclosure, triage, remediation, dependency checks, and release evidence; customer-specific cadence is in the Order Form |
| Logging/evidence | Sanitized security events and cryptographically verifiable audit evidence; no bearer tokens or raw private keys in governed logs |
| Incident response | Documented detection, containment, recovery, evidence, and notice; initial customer notice target within 24 hours after confirmation |
| Backup/recovery | Authenticated encrypted offsite backup, verified cold-passive encrypted sync, inventory-bound restore, and restore-time tenant erasure |
| Deletion | Active deletion within 30 days after verified request/termination; current erasure dispositions apply to restores; backup expiry bounded by the Order Form |
| Processors | Exact reviewed inventory incorporated through the DPA/Order Form; change notice and objection process apply |

## Assurance status

| Item | Status |
|---|---|
| SOC 2 report | Not claimed |
| ISO 27001 certification | Not claimed |
| PCI DSS validation | Not claimed; payment-card data is prohibited unless separately approved |
| HIPAA/HITRUST | Not claimed; protected health data is prohibited unless separately approved |
| FedRAMP | Not claimed |
| Penetration test | Customer-specific evidence availability must be confirmed in the Order Form |
| Cyber insurance | Customer-specific evidence availability must be confirmed before signature |
| Data residency | Deployment-specific; regions and subprocessors must be written in the Order Form |
| Service level | No default public SLA; any commitment and credit must be written in the Order Form |

## Requested evidence

Subject to scope, confidentiality, security, and availability, Vanteguard may
provide exact release/SBOM/provenance receipts, architecture and data-flow
material, control descriptions, vulnerability summaries, backup/restore
receipts, incident-process evidence, processor inventory, and completed
customer questionnaires. It will not provide private keys, exploitable
details, another customer’s information, unrestricted production access, or a
certification/report it does not hold.

## Customer-specific completion

Before production approval, the parties must complete legal entity and
contacts, exact product/release/topology, permitted/prohibited data, regions,
processors, identity model, support/SLA, recovery objectives, retention,
deletion, secure-exchange recipients/location, transfer mechanism, required
evidence, insurance, and open exceptions. An unanswered or “not claimed” item
cannot be represented as satisfied.