Overview
This approved policy defines how customers and authorized reviewers can evaluate the security, privacy, resilience and responsible-AI controls supporting OpsRabbit without exposing sensitive implementation details or disrupting operations. Public documents are the starting point; additional evidence is released in proportion to the request, actual deployment and applicable agreement.
The sections below explain available evidence, review stages, audit conditions, restricted material and remediation follow-up.
This policy does not itself create a contractual audit right. An enforceable audit right exists only when an executed agreement, such as an incorporated OpsRabbit DPA, grants it. Before execution, Applied AI Consulting may voluntarily provide public or controlled assurance evidence.
Evidence-first assurance
OpsRabbit provider responds to reasonable customer security reviews using current policies, architecture summaries, testing evidence, questionnaires and certifications available for the applicable scope. Public summaries should be used first; sensitive evidence is shared through a controlled process.
Available evidence
- Responsible AI Policy and AI Governance Framework
- Security Overview, data-flow documentation and shared-responsibility matrix
- Customer-safe VAPT completion evidence
- Incident-response and continuity summaries
- Current certification status and scope statements
- Data Processing Addendum, provider disclosure and security measures
- Scoped questionnaire responses and material corrective-action status appropriate for assurance
Audit conditions
If standard evidence is insufficient for obligations under an executed DPA, an audit request must be limited to relevant systems and processing, use qualified independent personnel, preserve confidentiality, avoid unreasonable operational disruption, and normally occur no more than once annually unless a breach, verified material noncompliance or regulator requires otherwise. The standard process requires at least thirty days’ written notice unless applicable law or a supervisory authority requires a shorter period. Commercial and cost terms are governed by the agreement.
Standard assurance sequence
- Use public Trust Center materials and current certificates.
- Submit a scoped questionnaire identifying the customer requirement.
- Request controlled evidence for gaps not addressed by public material.
- If contractual and still insufficient, request a focused independent audit.
This sequence protects customer assurance needs without exposing other customers’ data, source code, exploit details, personal information or privileged security architecture.
Request requirements
An audit request must identify the legal or contractual basis, control objective, systems and period in scope, proposed dates, auditor identity, evidence needed and confidentiality protections. Auditors must be suitably qualified and independent and may not be an OpsRabbit competitor. Reviews occur during reasonable business hours and must avoid disruption.
Frequency, cost and findings
Routine customer audits are normally limited to once in a twelve-month period. Additional review may be appropriate following a confirmed material incident, a regulator’s binding request, or documented evidence of material non-compliance. Unless the agreement states otherwise, the customer bears its audit costs. Findings must be disclosed promptly to OpsRabbit provider and handled confidentially; remediation timing is based on validated risk.
Restricted evidence
Raw penetration-test reports, source code, credentials, infrastructure identifiers, detailed network diagrams, employee records, other-customer information and active defensive configurations are not public. OpsRabbit provider may provide a summary, redacted extract, independent report or live review instead.
Refusal to disclose one artifact does not automatically close an assurance request. The control objective is recorded and an appropriate alternative is provided where one can safely address the requirement.