RFP pack
Copy-paste answers
Short-form responses for vendor risk questionnaires (internal / illustrative).
Last updated: 2026-01-21
How we're different
- Evidence-first with citation validation.
- Supervisor gates for sensitive actions.
- Audit exports with integrity proof.
Trust rule: AI drafts, humans decide for sensitive outcomes.
Short-form answers
Data handling & retention
Alertrun stores evidence objects (with hashes + provenance), narrative drafts, review decisions, and an append-only audit log for case history. Retention is policy-controlled and deployment-dependent; export workflows support examiner requests and internal retention controls. (Internal / hypothetical posture; not legal advice.)
Model usage & training
LLMs are used only for drafting and summarization under strict constraints. Narratives must cite evidence IDs, and a citation validator enforces compliance before submission. Alertrun does not train models on customer data by default unless explicitly agreed.
Access controls & audit logs
Role-based access controls separate investigator, supervisor, and admin actions. High-risk actions are policy-gated with supervisor approvals and rationale capture. Audit events are append-only and hash-chained; exports can be verified via an API endpoint.
Incident response
Alertrun follows an incident process: detect/contain, preserve evidence/audit logs, communicate scope and mitigations, and provide post-incident reporting. Response timelines depend on severity and customer deployment constraints (internal/hypothetical).
Deployment options
Alertrun supports local demos and pilots today, with roadmap options for dedicated VPC and on-prem deployments. Customers can align storage, networking, and model gateways with their existing security posture.
Logging and exports
Alertrun exports case bundles that include evidence lists, narrative drafts, review decisions, and audit logs. Audit integrity is verifiable via hash chain validation. Roadmap includes SIEM-style event streaming for centralized monitoring.