Who is this for?
For startups and companies that sell software to banks, insurers, payment providers or large corporates, and whose customer now wants a security questionnaire answered or a supplier review passed before the contract or the pilot goes live. Typical moments:
- the first security questionnaire from a large customer, often well over a hundred questions
- a pilot with a regulated buyer that ends in a supplier review
- a contract annex with security and exit requirements
- a review date and nobody on the team who owns the answers
It works with or without your own engineering team: without a technical lead, I take the preparation off your hands; with a CTO or head of IT, the Architecture Review gives them an independent view from outside.
What does a buyer ask?
Banks and insurers have to review their ICT suppliers, in the EU under DORA, in the United Kingdom under the PRA's outsourcing rules. The questions follow the same pattern:
- Where is our data processed and stored, and which subcontractors are involved?
- Who can access production and our data, and how is access granted, reviewed and removed?
- How is our data separated from other customers' data, and how do you test that?
- What do you log, how long do you keep it, and can we get the audit trail for our tenant?
- How do you back up and restore, and when did you last test a restore?
- How do we get our data back and leave?
The answers come from how the app is run
A questionnaire is hard to answer when nobody owns the operation. It is easy when accounts are in your name, access is documented, backups are restore-tested and an exit plan exists. That is why the preparation is part of operating your app, not a separate document exercise.
What the supplier pack contains
It comes with every operation tier and is adapted to your case:
- Service description: what is operated and to what extent
- List of subcontractors, such as cloud and AI services
- Incident process with response times
- Exit plan and data return
- Answers to common supplier questionnaire questions
How you get there
-
Check where you stand
One app with one backend: the App Check. Several systems or a team with its own IT: the Architecture Review.
-
Take over or set up
Accounts in your name, emergency handbook, account register and exit plan. Depending on the findings as a takeover, a rescue or the Setup for Care.
-
Operation with the supplier pack
Every operation tier includes the pack. With Your Technical Lead I also answer up to 4 questionnaires from your customers a year.
Start with the App Check at $2,000 for one app, or with the Architecture Review at $10,500 to $13,900 for several systems. Operation runs from $1,400 a month; Your Technical Lead at $7,200 a month includes up to four questionnaires a year. Details on app maintenance and operation. All prices are net; the tax treatment is clarified before contract and stated in the offer. You contract with DigitalFreedom Global LLC, Wyoming, USA.
Confidential from the first call: we are happy to sign an NDA before we talk.
Professional liability insurance in place, proof on request.
What this is not
No certification, no SOC 2 attestation (only CPA firms issue those), no ISO certificate, no legal advice and no penetration test. Nobody can promise you that a framework is met by signing a document, and nobody can promise that you pass the review. What you get instead: prepared answers, the gaps named honestly, and the evidence your architecture and operations already provide, put together so your customer's reviewer can follow it.
Who does the work?
I do, Marcel R. G. Berger, software architect: more than 20 years of enterprise engineering for banks, insurers, energy companies and public authorities: microservices, identity and access, instant payments. Today I build and run my own apps end to end. More on the About page; if the review shows that the app itself has to change, see services.