Security questionnaire answers

Fini (usefini.com) holds SOC 2 Type II and ISO 27001, supports GDPR and CCPA, is HIPAA-compliant with a BAA available, encrypts customer data with AES-256 at rest and TLS 1.2+ in transit, and never uses customer data to train foundation models. This page answers the questions security and procurement teams ask most often, with a source for every answer, so you can fill most of a SIG Lite or CAIQ style questionnaire without waiting on a call. The Fini Trust Center is the primary source for security documentation. Reports, policies, and the completed vendor security questionnaire listed there are shared on request through the Trust Center’s Get access flow. Where an answer below says “Available via the Trust Center on request”, the Trust Center lists that document.

How to use this page. Copy answers directly into your questionnaire, and attach the documents you request from the Trust Center as evidence. Contractual commitments (breach notice, subprocessor notice, transfer mechanisms) are set by the Data Processing Addendum and your MSA; if this page and a signed agreement ever differ, the agreement wins.

Search or filter every answer here. The sourced tables below carry the same answers with links to each source document.

Certifications and assessments

#	Question	Fini’s answer	Source
1	Do you hold a SOC 2 Type II report?	Yes. The SOC 2 Type II report is available via the Trust Center on request.	Trust Center, SOC 2 and ISO 27001
2	Are you ISO/IEC 27001 certified?	Yes. The ISO/IEC 27001 documentation is available via the Trust Center on request.	Trust Center
3	Do you comply with GDPR?	Yes. Fini acts as processor for Customer Data under the DPA (v1.0.5), with EU Standard Contractual Clauses (Modules Two and Three) and Swiss and UK addenda.	DPA
4	Do you comply with CCPA and other US state privacy laws?	Yes. The DPA covers Fini’s processor obligations under CCPA and other US state privacy laws.	DPA
5	Can you handle PHI, and will you sign a BAA?	Yes. Fini is HIPAA-compliant, with a BAA available.	HIPAA and BAAs
6	Are you PCI DSS compliant?	To confirm (see below).	PCI DSS
7	Do you perform independent penetration testing? Can we see the report?	Yes. Fini performs annual third-party penetration testing. The pentest report is available via the Trust Center on request.	Trust Center
8	Do you have a completed standard security questionnaire?	Yes. A completed Vendor Security Alliance questionnaire (VSA Full) is available via the Trust Center on request.	Trust Center
9	Do you conduct regular risk assessments?	Yes. Fini conducts an annual risk assessment. The Risk Assessment/Management Policy is available via the Trust Center on request.	Trust Center

Data protection and residency

#	Question	Fini’s answer	Source
10	Is customer data encrypted at rest?	Yes. All customer data is encrypted at rest with AES-256. The Encryption Policy is available via the Trust Center on request.	Trust Center
11	Is customer data encrypted in transit?	Yes, with TLS 1.2 or higher.	Trust Center
12	Where is customer data stored? Can we choose the region?	In the region you designate: United States or European Union. Fini’s infrastructure runs on Google Cloud in multiple US and EU regions.	Data handling, Trust Center
13	Who hosts the service?	Google Cloud. Physical security of the infrastructure is managed by Google Cloud. An Azure-hosted deployment in your own Azure tenant is available through Microsoft Marketplace, with Entra ID, Private Link, VNet, and customer-managed keys.	Trust Center, Fini on Azure
14	Which subprocessors do you use, and how are changes communicated?	Exhibit A of the DPA lists Google Cloud, Supabase, OpenAI, and Anthropic. Fini’s published subprocessors also include PostHog, Sentry, Stripe, Linear, and Langfuse. Request the full current list through the Trust Center. The DPA gives 30 days’ notice of subprocessor changes.	Trust Center, DPA
15	Will you sign a DPA?	Yes. Fini’s DPA (v1.0.5) is published and available to customers.	DPA
16	How long do you retain customer data? Can we request deletion?	Fini supports a 30-day retention policy, or deletion on request. On termination, data is deleted within 30 days under the Terms of Service.	Trust Center, Terms of Service
17	Is customer data used in development or test environments?	No. Customer data is not used in non-production environments.	Trust Center
18	Do you back up customer data?	Yes, on a regular basis, to recover from incidents that cause data loss. The Backup Policy is available via the Trust Center on request.	Trust Center
19	Do you classify data?	Yes. The Data Classification Policy is available via the Trust Center on request.	Trust Center

AI and model use

#	Question	Fini’s answer	Source
20	Is our data used to train AI models?	No. Customer data is never used to train foundation models, and Fini’s LLM subprocessors are contractually barred from training on it. The DPA commits to no model training on Customer Data.	DPA, Data handling
21	Which AI model providers process our data?	OpenAI and Anthropic, both for LLM inference under enterprise agreements. For an Azure-hosted deployment bought through Microsoft Marketplace, models run on Azure AI Foundry and Azure OpenAI Service in your Azure tenant.	Trust Center, Fini on Azure
22	How is personal data in conversations protected?	Guardrails check every generated reply before delivery. The Confidential attributes check blocks the values of user attributes you select from appearing in replies (it matches values; it is not blanket PII detection). If a reply can’t be rewritten safely, Fini replaces it with a handoff and escalates. Safety-triggered escalations show in Analytics under Guardrail or Safety Trigger.	Guardrails, Analytics
23	How do you control what the AI says and does?	Regulated workflows run as deterministic Intent Rules: the same conversation context produces the same tree walk and the same API call every time. Guardrails add banned-term, URL allowlist, AI disclosure, and custom checks, and Reply Rules decide when the agent replies, leaves an internal note, or stays silent.	Intent Rules, Guardrails
24	Can you show why the AI made a given decision?	Yes. Every conversation in Inbox has an AI Steps trace showing the attributes fetched, the rule steps that ran with pass or fail status, guardrail verdicts, and the reasoning behind its tags.	AI Steps trace

Access control and authentication

#	Question	Fini’s answer	Source
25	Do you support SSO?	Yes. Fini supports SAML 2.0 single sign-on with Okta as the identity provider.	Okta SSO
26	Do you support multi-factor authentication?	The Trust Center lists multi-factor authentication as implemented. With SSO, your identity provider’s MFA policy governs sign-in.	Trust Center, Okta SSO
27	Do you support role-based access control?	Yes. The Trust Center lists role-based access control. The Access Control Policy is available via the Trust Center on request.	Trust Center
28	How is employee access to customer data controlled and monitored?	Access is provisioned under Fini’s Access Control Policy, and access to the portal is monitored with Google Cloud Security Command Center.	Trust Center
29	How are API keys and credentials protected?	API keys are scoped (for example, `read` for non-mutating operations) and stored in an encrypted database. User credentials are salted, hashed, and stored by Supabase, and infrastructure secrets are kept in a secure key vault.	API keys, Trust Center

Logging, monitoring, and vulnerability management

#	Question	Fini’s answer	Source
30	Do you keep audit logs?	Yes. The Trust Center lists audit logging, and important infrastructure logs are centrally stored and monitored (SIEM). Per-conversation decisions are recorded in the AI Steps trace.	Trust Center
31	How do you detect intrusions and threats?	Firewalls control traffic, network activity is centrally logged with detection logic for anomalous behavior (IDS/IPS), and Fini’s team monitors for known attacker techniques and hunts for unknown threats on a regular cadence.	Trust Center
32	How do you manage vulnerabilities and patching?	Fini runs a formal vulnerability management process and applies patches on a documented SLA. Code and third-party dependencies are scanned, and the secure development policy requires peer review, automated testing, and static code analysis before production. The Vulnerability Management Policy is available via the Trust Center on request.	Trust Center
33	Do you have a vulnerability disclosure process?	Yes. Report suspected vulnerabilities through Report issue on the Trust Center.	Trust Center

Incident response and business continuity

#	Question	Fini’s answer	Source
34	Do you have an incident response plan?	Yes. Fini has a documented Incident Response Plan that is reviewed, tested, and approved at least annually. The Incident Response Policy is available via the Trust Center on request.	Trust Center
35	How quickly will you notify us of a breach?	Within 72 hours of a personal data breach involving Customer Data, under the DPA.	DPA
36	Do you have a BC/DR plan? What are your RTO and RPO?	Yes. Fini has a formal Business Continuity and Disaster Recovery plan, exercised, reviewed, and approved annually. The Trust Center risk profile lists a Recovery Time Objective of 24-48 hours and a Recovery Point Objective of 24-48 hours. The BC/DR Policy is available via the Trust Center on request.	Trust Center
37	What uptime do you commit to?	A 99.9% monthly uptime target under the Terms of Service. Contractual SLAs are defined in the customer’s MSA.	Terms of Service

People and corporate security

#	Question	Fini’s answer	Source
38	Do employees undergo background checks and security training?	Yes. New employees pass a background check and sign an NDA, and all personnel complete security and privacy awareness training annually (passwords, mobile devices, social engineering, physical security, phishing, and GDPR).	Trust Center
39	How are employee devices secured?	Employee endpoints use full-disk encryption, central management through MDM, endpoint detection and response, and DNS filtering.	Trust Center
40	Do you carry cyber insurance?	To confirm (see below).	Trust Center

Customers can also request Fini’s compliance reports (SOC 2, ISO 27001, GDPR) under the Trust Center’s customer audit rights. For privacy and legal questions, contact legal@usefini.com.

To confirm (internal, remove before publish):

PCI DSS (row 6). The usefini.com homepage claims PCI DSS Level 1, but the Trust Center lists only GDPR, ISO/IEC 27001, and SOC 2. What is the exact PCI status (level, attestation type, scope), and is an AOC available to share?
SSO (row 25). The Trust Center marks “SSO Support” as in progress, while the docs describe live Okta SAML 2.0 SSO. Update the Trust Center, and confirm whether IdPs other than Okta (for example Microsoft Entra ID or Google) are supported.
MFA (row 26). Does the Trust Center MFA entry cover customer dashboard users or only Fini employees? Can a customer enforce MFA for non-SSO logins?
EU residency and LLM inference (rows 12 and 21). The subprocessor data embedded in the Trust Center page lists OpenAI and Anthropic with location “US”. For a customer who designates EU residency, does LLM inference stay in the EU (for example through Microsoft Azure), or is it processed in the US under the SCCs?
Model training (row 20). The Trust Center’s privacy entry says “When we train our custom models for our customers we remove any personally identifiable information from data.” Does Fini train per-customer custom models on Customer Data? If so, the “never used to train” wording needs a precise qualifier (foundation or shared models).
Cyber insurance (row 40). The Trust Center lists a Cyber Insurance document, but its explanation reads “We are working on an insurance policy with cyber coverage.” Is a policy in force, and what is the coverage?
Subprocessor list (row 14). The Trust Center’s subprocessor section is hidden (“We are working on our subprocessors. Please contact us for more details.”), and its Subprocessors tile shows logos for OpenAI, Supabase, Amazon Web Services (AWS), Microsoft Azure and Google Cloud. AWS appears in no other Fini source. Is AWS a subprocessor, and what does Azure process outside Marketplace deployments? Publish the full list so row 14 can point to it.
Log retention (row 30). How long are audit logs and conversation traces retained, and can customers export audit logs?

Security overview

How Fini secures customer data, and where each document lives.

Data handling, residency and model training

Residency, retention, subprocessors, and model training in depth.

Questions to ask an AI support vendor

Evaluation questions beyond security, with Fini’s answers.

RFP fact sheet

Copy-ready company and product facts for RFPs.

Security & compliance

Plans & billing

Evaluate Fini

Security questionnaire answers

Certifications and assessments

Data protection and residency

AI and model use

Access control and authentication

Logging, monitoring, and vulnerability management

Incident response and business continuity

People and corporate security

Security overview

Data handling, residency and model training

Questions to ask an AI support vendor

RFP fact sheet

​Certifications and assessments

​Data protection and residency

​AI and model use

​Access control and authentication

​Logging, monitoring, and vulnerability management

​Incident response and business continuity

​People and corporate security

​Related

Security overview

Data handling, residency and model training

Questions to ask an AI support vendor

RFP fact sheet

Certifications and assessments

Data protection and residency

AI and model use

Access control and authentication

Logging, monitoring, and vulnerability management

Incident response and business continuity

People and corporate security

Related