Trust Center
Vendor risk profile
Our vendor-risk profile answers what third-party risk teams score first: data handled, hosting, access control and testing. It maps to SIG Lite and CAIQ and exports in 3 formats.
In short
Remote Pro Ai’s vendor-risk profile summarises the facts third-party risk teams score first: what data we handle, where it’s hosted, how access is controlled and how we test it. It’s mapped to SIG Lite and CAIQ, exportable in 3 formats, and backed by evidence you can open under NDA.
Vendor risk profile at a glance
| Area | Answer |
|---|---|
| Data types | Business contact data, contracts, timesheets, invoices; client code and data only inside the client's chosen environment |
| Hosting | Today, inside the client's own environment: no client data on Remote Pro Ai systems. Hosting regions in Riyadh, Frankfurt and Virginia are planned for the platform launch and not contracted yet |
| Access | SSO and MFA enforced for all staff; least-privilege roles; access reviews logged |
| Devices | MDM-managed, encrypted company devices, or the client's VDI |
| Penetration testing | Independent test of Client OS and Talent OS, annually and after every major release |
| Incident notification | Within 24 hours of confirming an incident affecting client data |
| People | Background checks for every engineer; signed code of conduct and NDA |
Mapped to SIG Lite and CAIQ
Completed SIG Lite and CAIQ questionnaires are available after NDA. Each answer references the policy or evidence behind it, so your analysts can trace claims rather than take them on trust.
Controls summary
- Governance: named security lead, policies reviewed yearly, risk register.
- Secure development: code review on every merge, secrets scanning, dependency scanning.
- AI use: approved tools only, zero-retention modes, AI-assisted changes labelled in pull requests.
- Monitoring: centralised logging, anomaly alerts on bulk repo access and off-hours activity.
- Vendor management: subprocessors under DPAs with 30-day change notice.
Insurance
Remote Pro Ai carries professional indemnity and cyber liability insurance. Certificates are available on request and can name your organisation as certificate holder.
Business continuity
Delivery runs from 2 offices, Cairo (HQ) and Al-Khobar, so a disruption at one site doesn't stop your squad. Every seat has 2 named and 2 pool standbys. Client OS recovery objectives are RTO 4 hours and RPO 1 hour, and the business continuity summary explains how we meet them.
Export the profile
JSON follows a flat question-answer format most GRC tools can import.
Frequently asked questions
It covers the questions third-party risk teams score first: data types handled, hosting regions, access control, device management, penetration testing, incident notification, insurance and business continuity. Each line maps to SIG Lite and CAIQ, and the supporting evidence is available under a click-through NDA.
Yes. Export it as JSON in a flat question-answer format, as XLSX for spreadsheet-based reviews, or as PDF for the vendor file. The evidence bundle on the documents page adds file hashes so reviewers can confirm the documents haven't changed since export.
Within 24 hours of confirming an incident that affects client data, through your named contacts and Client OS. Critical incidents are handled as P1, with a first response within 1 hour, 24/7, and a written postmortem afterwards. The notice states what happened, which data was involved and what you should do.
Delivery runs from our offices in Cairo and Al-Khobar, and every seat has 2 named and 2 pool standbys. If an engineer can't work, a standby takes over under the Remote Pro Ai Guarantee: a replacement starts within 4 working days; the full handover completes in under 14 days.
Yes. Remote Pro Ai holds professional indemnity and cyber liability cover. Request a certificate from this page or from the procurement pack in Client OS; we can name your organisation as certificate holder for your vendor file. Certificates show the insurer, the cover period and the policy limits.