Limit the inputs
The assessment uses one report and up to three agreed source exports for a defined reporting period. Format, volume, necessary fields, and permissions are confirmed before work begins.
Defined with the assessment scopeGovernance & security
Clear boundaries for the information you share.
A reporting assessment starts with agreed exports and handling arrangements. A production application has additional access, hosting, recovery, and support requirements. Those are separate scopes.
Assessment scope and data handling.
Agree handling before transfer
The scope must identify the approved transfer method, storage location, people with access, and return or deletion arrangements. Use sanitized inputs where they can answer the agreed question.
Written agreement before files are sharedReview tools and providers
Any proposed third-party service, including an AI provider, needs an agreed data boundary before receiving assessment information. The public demo is not an upload destination for client records.
Provider choices require agreementKeep the findings traceable
The deliverables distinguish source evidence, approved definitions, explained differences, and unresolved questions. The report owner reviews the findings and recommended next steps.
Part of the assessment deliverablesProduction application readiness. ORGA does not claim SOC 2, ISO 27001, HIPAA certification, penetration testing, an uptime guarantee, or a universal data-residency posture. The application requires a dedicated client data environment before any external-client or sensitive production data is onboarded. Assessment exports must stay within the separately agreed handling arrangements.
Controls for a separately scoped production application.
Authentication and access
The application supports individual authentication, active organization membership, and role-based access. Final identity requirements, including MFA or SSO, must be confirmed per engagement.
Implemented foundation; scope-specific confirmationData encryption
Production vendors generally provide encryption capabilities, but ORGA has not published a client-specific encryption standard or key-management commitment.
Pre-contract technical confirmation requiredKPI lineage and audit history
The product model supports definitions, source relationships, validation records, and audit events. Durable audit scope and retention must be defined for each client.
Implemented model; retention not publicly committedFreshness and validation
KPIs can carry refresh expectations, source references, validation dates, and status. Client owners remain responsible for approving business definitions.
Defined in application architectureBackups and recovery
No public recovery-time, recovery-point, or tested-restore commitment is made. Backup provider, schedule, retention, and restoration testing belong in the client architecture.
Pre-contract decision requiredHosting and data residency
Hosting region, vendor, environment separation, and residency requirements are selected and documented for the engagement. ORGA makes no blanket residency claim.
Pre-contract decision requiredAI providers and model data handling
Approved providers, model endpoints, retention settings, and what context may be sent are documented before AI-assisted features are enabled.
Provider-specific review requiredExternal model training
ORGA does not promise a universal answer across providers. The contract and selected provider settings must expressly state whether customer data can be used for training.
Must be prohibited or disclosed in contractLogging and incident response
Security-relevant logging and response responsibilities are scoped per client. ORGA does not claim a certified or independently audited incident-response program.
Operating procedure must be confirmedOwnership and source code
The intended model is a client-owned application. Exact ownership of code, reusable ORGA components, infrastructure, credentials, and third-party licenses must be stated in the agreement.
To be agreed in writing before implementationPortability and offboarding
Data export, credential transfer, repository access, transition support, deletion, and retention should be explicit before work begins.
To be agreed in writing before implementationORGA maintenance
ORGA’s maintenance responsibilities may include integrations, application updates, monitoring, security work, and AI evaluation only as specified in the service agreement.
Scope-specific service terms requiredResponsibilities belong in the agreement.
The assessment agreement defines its inputs, deliverables, access, and handling. Any later application agreement must also define ownership, the client’s access decisions, maintenance responsibilities, and offboarding.
Before production data is introduced to a new application, both parties must agree the data inventory, role model, provider list, access process, recovery requirements, AI handling rules, and offboarding plan.
Reporting Clarity Assessment
Start with one report worth getting right.
$1,500 fixed fee. One report · up to three source exports · up to three key measures. Agree the fit and scope before payment.