![](media/image1.jpg){width="2.5077438757655295in"
height="1.7291666666666667in"}

**THIRD-PARTY RISK MANAGEMENT PACKAGE**

**Financial Services Vendor Due Diligence**

**Version:** 2.0\
**Last Updated:** January 2026\
**Valid Through:** December 2026

**PACKAGE CONTENTS**

This package contains pre-completed responses to standard financial
services vendor due diligence questionnaires:

1.  **Vendor Information Summary** - Quick reference sheet

2.  **SIG (Standardized Information Gathering) Questionnaire** -
    > Complete responses

3.  **CAIQ (Consensus Assessments Initiative Questionnaire)** - Cloud
    > security assessment

4.  **OCC Third-Party Risk Assessment** - Banking regulator requirements

5.  **SOC 2 Type II Report** - Independent security audit (under NDA)

6.  **Financial Services Addendum** - Industry-specific information

7.  **Supporting Evidence Library** - Certifications, policies,
    > attestations

**1. VENDOR INFORMATION SUMMARY**

**Company Profile**

  Item                   Details
  ---------------------- ------------------------------------------------------------------
  **Legal Name**         Proof Labs LLC
  **DBA**                Phase Mirror
  **Type of Entity**     Limited Liability Company (LLC)
  **Jurisdiction**       \[State\], United States
  **Year Established**   \[Year\]
  **DUNS Number**        \[Number\]
  **Tax ID (EIN)**       \[Available upon request under NDA\]
  **Primary Business**   AI Governance SaaS Platform and Consulting Services
  **Website**            [[https://phasemirror.com]{.underline}](https://phasemirror.com)
  **Headquarters**       \[Address\]

**Key Personnel**

  Role                                     Name       Email                          Background
  ---------------------------------------- ---------- ------------------------------ ----------------------
  **CEO**                                  \[Name\]   \[Email\]                      \[Brief background\]
  **Chief Information Security Officer**   \[Name\]   \[security\@phasemirror.io\]   \[Brief background\]
  **Data Protection Officer**              \[Name\]   \[dpo\@phasemirror.io\]        \[Brief background\]
  **General Counsel**                      \[Name\]   \[legal\@phasemirror.io\]      \[Brief background\]

**Service Overview**

**Primary Services for Financial Institutions:**

1.  **Phase Mirror Oracle Platform (SaaS)**

    -   AI governance and dissonance detection

    -   Compliance monitoring for AI systems

    -   Risk classification for EU AI Act

    -   Model risk management support (SR 11-7 alignment)

2.  **Financial Services Compliance
    > Pack**[^[\[1\]]{.underline}^](#d43kwqsx3gjg)

    -   SEC AI disclosure support

    -   Model risk management (Federal Reserve SR 11-7)

    -   Fair lending compliance rules

    -   GLBA privacy and security controls

3.  **Consulting Services**

    -   AI Governance Diagnostic

    -   Compliance-Accuracy Tradeoff Workshop

    -   Advisory retainer services

4.  **Implementation & Support**

    -   Platform deployment

    -   Integration services

    -   Tiered support (Standard/Priority/Premium)

**Financial Information**

  Item                               Status
  ---------------------------------- -----------------------------------------------------------------
  **Annual Revenue**                 \[Range: \<\$5M / \$5-10M / \$10-50M / \>\$50M\]
  **Funding Status**                 \[Bootstrapped / Seed / Series A / etc.\]
  **Financial Stability**            Profitable / Break-even / Growth stage with \[X\] months runway
  **D&B Credit Rating**              \[Rating\]
  **Audited Financials Available**   Yes (under NDA) / No
  **Cyber Insurance**                Yes - \$\[Amount\]M coverage
  **E&O Insurance**                  Yes - \$\[Amount\]M coverage

**Regulatory & Compliance**

  Framework                  Status                               Evidence Available
  -------------------------- ------------------------------------ ------------------------
  **SOC 2 Type II**          Current (expires \[Date\])           Yes (under NDA)
  **ISO 27001**              Planned \[Date\] / Certified         Certificate available
  **HIPAA**                  Compliant (BAA available)            BAA template, policies
  **GDPR**                   Compliant (DPA available)            DPA template, TIA
  **CCPA**                   Compliant                            Privacy policy
  **GLBA Safeguards Rule**   Compliant                            Security documentation
  **SOX Controls**           Available for Enterprise customers   Control documentation

**2. SIG QUESTIONNAIRE RESPONSES**

**Section A: Company Overview**

**A.1 Provide a brief description of your company and the services you
provide.**

Phase Mirror provides AI governance infrastructure for regulated
enterprises. Our flagship product, the Phase Mirror Oracle, is a SaaS
platform that identifies contradictions between AI system governance
policies and actual implementation. We serve financial services,
healthcare, and other regulated industries requiring defensible AI
governance frameworks. Our methodology surfaces productive
contradictions (dissonances) and converts them into concrete governance
levers with owners, metrics, and
timelines.[^[\[2\]]{.underline}^](#kcs21g36n6uc)[^[\[3\]]{.underline}^](#hnbjz1xy20zs)

**A.2 How many years has your company been in business?**

\[X\] years (established \[Year\])

**A.3 How many customers does your company currently serve?**

\[Number\] customers, including \[X\] in financial services sector

**A.4 List your top 5 customers in the financial services industry (if
permissible).**

\[Available under NDA upon request\]

**A.5 Does your company operate globally? If yes, list countries.**

Primary operations: United States\
Services available: Global (with data residency options for EU, UK, and
other jurisdictions)

**A.6 Total number of employees and contractors:**

-   Full-time employees: \[Number\]

-   Contractors: \[Number\]

-   Employees with access to customer data: \[Number\]

-   Security personnel: \[Number\]

**A.7 Is your company publicly traded or privately held?**

Privately held LLC. \[If applicable: Ownership structure available under
NDA\]

**A.8 Have there been any recent changes in ownership, mergers, or
acquisitions?**

☐ No\
☐ Yes (explain): \[Details\]

**A.9 Is your company involved in any current litigation that could
impact service delivery?**

☐ No\
☐ Yes (explain): \[Details available under NDA\]

**A.10 Has your company experienced any significant financial distress
in the past 3 years?**

☐ No\
☐ Yes (explain): \[Details\]

**Section B: Information Security Program**

**B.1 Does your organization have a formal Information Security
Program?**

☑ Yes

**B.2 Who is responsible for your Information Security Program?**

Chief Information Security Officer (CISO): \[Name\]\
Reports to: CEO\
Committee oversight: Security & Compliance Committee

**B.3 Is there a dedicated security team? If yes, how many members?**

☑ Yes - \[X\] dedicated security personnel

-   1 CISO

-   \[X\] Security Engineers

-   \[X\] Security Operations

-   1 Data Protection Officer

**B.4 Does your organization have an Information Security Policy? When
was it last reviewed?**

☑ Yes

-   Last reviewed: \[Date\]

-   Review frequency: Annually

-   Approved by: Board / Executive Committee

-   Available upon request: Yes (under NDA)

**B.5 List all security certifications and attestations:**

  Certification                  Status       Audit Date   Next Audit
  ------------------------------ ------------ ------------ ------------
  SOC 2 Type II                  Current      \[Date\]     \[Date\]
  ISO 27001                      \[Status\]   \[Date\]     \[Date\]
  Cloud Security Alliance STAR   \[Status\]   \[Date\]     N/A

**B.6 When was your last external security audit or penetration test?**

-   Last penetration test: \[Date\]

-   Conducted by: \[Firm name\]

-   Scope: External perimeter, web applications, APIs

-   Critical findings: \[None / X findings, all remediated\]

-   Remediation timeline: \[All issues resolved within X days\]

-   Next scheduled test: \[Date\]

**B.7 Have you experienced any security breaches in the past 3 years?**

☐ No security breaches involving customer data\
☐ Yes (details below):

-   Date: \[Date\]

-   Nature: \[Description\]

-   Impact: \[Scope\]

-   Notification: \[Customers notified within X hours\]

-   Remediation: \[Actions taken\]

-   Regulatory response: \[None / Details\]

**B.8 Does your organization have a Security Incident Response Plan?**

☑ Yes

-   Last updated: \[Date\]

-   Last tested: \[Date\]

-   Testing frequency: Semi-annually

-   Incident response team: 24/7 on-call rotation

-   Customer notification SLA: 24 hours for material incidents

-   Available for review: Yes (under NDA)

**B.9 What is your security incident notification timeline to
customers?**

-   Material incidents: Within 24 hours of confirmation

-   Data breaches: Within 24 hours of discovery

-   Service disruptions: Real-time status page updates

-   Notification method: Email to primary contacts + in-platform alerts

**Section C: Data Security & Privacy**

**C.1 Describe how customer data is encrypted:**

  State            Encryption Method                   Key Management
  ---------------- ----------------------------------- ---------------------------------------------------
  **At Rest**      AES-256                             Customer-managed keys available (Enterprise tier)
  **In Transit**   TLS 1.3                             Certificate pinning, Perfect Forward Secrecy
  **Backups**      AES-256                             Separate key hierarchy
  **Database**     Transparent Data Encryption (TDE)   Automated key rotation (90 days)

**C.2 Where is customer data stored (geographic locations)?**

**Primary Options:**

-   ☑ United States (US-East, US-West)

-   ☑ European Union (EU-West - Ireland, Frankfurt)

-   ☐ United Kingdom

-   ☐ Asia-Pacific (available on request)

**Financial Services Customers:**\
Default: US-only data residency (complies with data localization
requirements)\
Enterprise tier: Dedicated instance in customer-specified region

**C.3 Do you use third-party cloud providers? If yes, list providers:**

  Provider              Service                            Location     Certification
  --------------------- ---------------------------------- ------------ ---------------------------
  \[AWS/Azure/GCP\]     Infrastructure, compute, storage   \[Region\]   SOC 2, ISO 27001, FedRAMP
  \[Backup provider\]   Encrypted backups                  \[Region\]   SOC 2

All cloud providers:

-   SOC 2 Type II certified

-   Contractually bound to equivalent security standards

-   Subject to annual security reviews

-   Covered by Business Associate Agreements (where applicable)

**C.4 Do you support data residency requirements?**

☑ Yes

-   US-only processing: Available for all tiers

-   EU-only processing: Available for Enterprise tier

-   Dedicated instances: Available for Enterprise tier

-   Data sovereignty guarantees: Contractually committed

**C.5 What data retention policies do you maintain?**

  Data Type                     Retention Period                   Deletion Method
  ----------------------------- ---------------------------------- ---------------------------------
  **Active customer data**      Duration of subscription           N/A
  **Terminated account data**   30 days post-termination           Secure deletion + certification
  **Audit logs**                2 years (7 years for Enterprise)   Automated purge
  **Backups**                   90 days rolling                    Encrypted overwrite
  **Financial records**         7 years (regulatory requirement)   Secure destruction

**C.6 How do you handle data deletion requests?**

-   Deletion timeline: Within 30 days of request

-   Deletion method: Secure deletion per NIST 800-88 guidelines

-   Certification provided: Yes, upon request

-   Backup deletion: Within 90 days (backup rotation cycle)

-   Verification: Deletion verification report available

**C.7 Do you have a Data Protection Officer or Privacy Officer?**

☑ Yes

-   Title: Data Protection Officer (DPO)

-   Name: \[Name\]

-   Email:
    > [[dpo\@phasemirror.io]{.underline}](mailto:dpo@phasemirror.io)

-   Responsibilities: GDPR compliance, privacy program, breach response

-   Availability: Customer inquiries responded to within 2 business days

**C.8 Are you compliant with the following regulations?**

  Regulation      Compliant                         Evidence Available
  --------------- --------------------------------- ------------------------------------------
  **GDPR**        ☑ Yes                             DPA template, Privacy Policy, TIA
  **CCPA/CPRA**   ☑ Yes                             Privacy Policy, DSAR procedures
  **GLBA**        ☑ Yes                             Safeguards documentation, Privacy Notice
  **SOX**         ☑ Yes (for applicable controls)   Control documentation
  **HIPAA**       ☑ Yes (when applicable)           BAA template, Security documentation
  **EU AI Act**   ☑ Yes                             Compliance Pack, documentation support

**C.9 Do you conduct Data Protection Impact Assessments (DPIAs)?**

☑ Yes

-   For all new processing activities involving personal data

-   For changes to existing processing that increase risk

-   Available to customers upon request (for their own DPIAs)

-   Last DPIA: \[Date\] for \[Processing activity\]

**Section D: Access Controls**

**D.1 Describe your authentication mechanisms:**

  Control                                 Implementation
  --------------------------------------- ---------------------------------------------------------------------
  **Multi-Factor Authentication (MFA)**   Required for all user accounts (Platform and administrative)
  **Single Sign-On (SSO)**                SAML 2.0 support (Enterprise tier)
  **Password Requirements**               Min 12 characters, complexity requirements, no reuse of last 12
  **Session Management**                  30-minute idle timeout, secure session tokens
  **Failed Login Protection**             Account lockout after 5 failed attempts (15-minute lockout)
  **Privileged Access**                   Separate admin accounts, break-glass procedures, full audit logging

**D.2 How do you manage employee access to customer data?**

**Access Principles:**

-   Least privilege: Access granted only as necessary for job function

-   Need-to-know: Access limited to minimum data required

-   Role-based: RBAC with predefined roles (Developer, Support,
    > Security, Admin)

-   Time-limited: Temporary elevated access expires automatically

**Access Process:**

1.  Request via ticketing system with business justification

2.  Manager approval required

3.  Security review for privileged access

4.  Automated provisioning with expiration date

5.  Full audit logging of all access

**D.3 How frequently are access rights reviewed?**

-   Quarterly access reviews: All personnel access rights validated

-   Annual certification: Managers certify team member access
    > appropriate

-   Immediate revocation: Upon termination or role change

-   Automated alerts: For dormant accounts (\>90 days no activity)

**D.4 How do you manage third-party vendor access?**

-   Separate vendor accounts (no shared credentials)

-   Minimum necessary access scope

-   Time-bound access (automatically expires)

-   MFA required for all vendor access

-   Audit logging of all vendor activity

-   Annual vendor security assessments

-   Contractual data protection obligations

**D.5 Do you conduct background checks on employees?**

☑ Yes

-   Scope: All employees with access to customer data

-   Includes: Criminal history, employment verification, education
    > verification

-   Frequency: Pre-employment

-   Geographic scope: US-based employees (US checks), international
    > employees (local equivalent)

-   Exceptions: None for personnel with data access

**Section E: Business Continuity & Disaster Recovery**

**E.1 Do you have a Business Continuity Plan (BCP)?**

☑ Yes

-   Last updated: \[Date\]

-   Last tested: \[Date\]

-   Test frequency: Annually

-   Test scope: Full failover exercise

-   Available for review: Executive summary available (full plan under
    > NDA)

**E.2 Do you have a Disaster Recovery Plan (DRP)?**

☑ Yes

-   Last updated: \[Date\]

-   Last tested: \[Date\]

-   Test frequency: Semi-annually

-   Test results: \[Last test date\] - \[Success / Issues identified and
    > remediated\]

**E.3 What are your Recovery Time Objectives (RTO) and Recovery Point
Objectives (RPO)?**

  Tier             RTO        RPO        SLA Uptime
  ---------------- ---------- ---------- ------------
  **Team**         24 hours   24 hours   99.0%
  **Business**     8 hours    4 hours    99.5%
  **Enterprise**   4 hours    1 hour     99.9%

**E.4 Describe your backup procedures:**

-   **Frequency:** Daily automated backups

-   **Retention:** 90 days rolling retention

-   **Storage:** Geo-redundant storage (minimum 3 availability zones)

-   **Encryption:** AES-256 encrypted backups

-   **Testing:** Monthly restoration tests on random sample

-   **Segregation:** Backups stored separately from production
    > environment

**E.5 Where are backups stored?**

-   **Primary backup location:** \[Region 1\]

-   **Secondary backup location:** \[Region 2\] (geographic redundancy)

-   **Segregation:** Separate AWS/Azure account for backup isolation

-   **Access control:** Restricted to backup administrators only

**E.6 Have you experienced any significant service outages in the past
12 months?**

☐ No significant outages (\>30 minutes)\
☐ Yes (details below):

-   Date: \[Date\]

-   Duration: \[X\] hours

-   Impact: \[Service affected, % customers impacted\]

-   Root cause: \[Description\]

-   Remediation: \[Actions taken\]

-   Prevention: \[Measures to prevent recurrence\]

**E.7 How do you communicate service disruptions to customers?**

-   **Status page:**
    > [[https://status.phasemirror.com]{.underline}](https://status.phasemirror.com)
    > (real-time updates)

-   **Email notifications:** Automated alerts to primary contacts

-   **In-platform notifications:** Banner alerts for active users

-   **Escalation:** Direct outreach for Enterprise customers (TAM
    > notification)

-   **Post-incident reports:** Provided within 5 business days (root
    > cause, remediation, prevention)

**Section F: Vendor & Supply Chain Management**

**F.1 Do you have a Vendor Risk Management program?**

☑ Yes

-   Program owner: CISO

-   Scope: All vendors with access to customer data or critical systems

-   Process: Pre-engagement security assessment, annual reviews,
    > continuous monitoring

-   Documentation: Vendor risk register maintained

**F.2 List all critical subcontractors/vendors with access to customer
data:**

  Vendor                 Service                  Data Access                     Location     Security Review Date
  ---------------------- ------------------------ ------------------------------- ------------ ----------------------
  \[Cloud provider\]     Infrastructure hosting   Full access to encrypted data   \[Region\]   \[Date\]
  \[Backup provider\]    Encrypted backups        Encrypted backups only          \[Region\]   \[Date\]
  \[Email provider\]     Transactional email      Email addresses, names          \[Region\]   \[Date\]
  \[Support platform\]   Customer support         Support ticket content          \[Region\]   \[Date\]

**Full subcontractor list available in:** DPA Annex III (Sub-processors)

**F.3 How do you assess vendor security?**

-   Pre-engagement security questionnaire (SIG or equivalent)

-   Review of vendor SOC 2 / ISO 27001 certifications

-   Contractual data protection obligations

-   Annual security reassessment

-   Continuous monitoring (security alerts, breach notifications)

**F.4 Do you have written agreements with all vendors handling customer
data?**

☑ Yes - All vendors sign:

-   Data Processing Agreement (DPA)

-   Business Associate Agreement (BAA) if handling PHI

-   Standard Contractual Clauses (SCCs) for international transfers

-   Service Level Agreement (SLA)

**F.5 What is your vendor offboarding process?**

1.  Data return or destruction within 30 days

2.  Access revocation (immediate upon contract termination)

3.  Certification of data deletion

4.  Verification of credential removal

5.  Final security review and closeout

**Section G: Regulatory Compliance & Audit**

**G.1 Have you been audited by financial services regulators (OCC,
Federal Reserve, SEC, FINRA, etc.)?**

☐ No (not directly regulated)\
☑ Yes, as part of customer audits:

-   Regulator: \[Name\]

-   Date: \[Date\]

-   Findings: \[None / Details\]

-   Remediation: \[N/A / Actions taken\]

**G.2 Are you familiar with financial services regulatory
requirements?**

☑ Yes - Our Financial Services Compliance Pack
includes:[^[\[1\]]{.underline}^](#d43kwqsx3gjg)

-   SEC AI disclosure support (material risk disclosure)

-   Federal Reserve SR 11-7 (Model Risk Management)

-   Fair lending compliance rules

-   GLBA safeguards and privacy

-   Bank Secrecy Act (BSA) / Anti-Money Laundering (AML) considerations

-   SOX internal controls support

**G.3 Can you support customer audit requirements?**

☑ Yes

-   Audit support included in Enterprise tier

-   Right-to-audit clause in agreements

-   Coordination with customer internal audit teams

-   Support for regulatory exams (OCC, Federal Reserve, etc.)

-   Documentation packages prepared within 10 business days

-   On-site audits accommodated with 30 days\' notice

**G.4 Do you maintain audit trails?**

☑ Yes

  Activity                 Logged   Retention                      Immutable
  ------------------------ -------- ------------------------------ -----------
  User authentication      ☑        2 years (7 years Enterprise)   ☑
  Data access              ☑        2 years (7 years Enterprise)   ☑
  Configuration changes    ☑        2 years (7 years Enterprise)   ☑
  Administrative actions   ☑        7 years                        ☑
  API calls                ☑        90 days                        ☑

**Audit log features:**

-   Tamper-evident (write-once-read-many storage)

-   Centralized log management (SIEM integration)

-   Real-time alerting on suspicious activity

-   Customer access to their audit logs (Enterprise tier)

**G.5 Can you provide evidence of compliance with SOX requirements?**

☑ Yes (for Enterprise customers requiring SOX controls)

**Available documentation:**

-   SOC 1 Type II report (IT General Controls) - Available upon request

-   Control descriptions and testing results

-   Change management procedures

-   Access control documentation

-   Segregation of duties matrix

**Section H: Insurance & Financial Stability**

**H.1 Do you carry Cyber Liability Insurance?**

☑ Yes

-   Coverage amount: \$\[X\] million

-   Coverage includes: Data breach response, regulatory defense,
    > third-party liability

-   Insurer: \[Name\]

-   Policy period: \[Start date\] - \[End date\]

-   Certificate available: Yes (upon request)

**H.2 Do you carry Errors & Omissions (E&O) Insurance?**

☑ Yes

-   Coverage amount: \$\[X\] million

-   Coverage includes: Professional liability, technology E&O

-   Insurer: \[Name\]

-   Policy period: \[Start date\] - \[End date\]

**H.3 Do you carry General Liability Insurance?**

☑ Yes

-   Coverage amount: \$\[X\] million

-   Insurer: \[Name\]

-   Policy period: \[Start date\] - \[End date\]

**H.4 Are audited financial statements available?**

☐ Yes (under NDA)\
☐ No (provide alternative evidence):

-   D&B credit report available

-   Bank reference letters available

-   Management representation of financial stability

**H.5 What is your company\'s financial runway?**

\[X\] months of operating capital / Profitable / Break-even

**Section I: Service Level Agreements (SLAs)**

**I.1 What uptime guarantees do you provide?**

  Tier         Monthly Uptime SLA   Downtime Allowance   Service Credit
  ------------ -------------------- -------------------- -----------------
  Team         99.0%                \~7.3 hours/month    10% monthly fee
  Business     99.5%                \~3.6 hours/month    25% monthly fee
  Enterprise   99.9%                \~43 minutes/month   50% monthly fee

**Uptime measurement:**

-   24/7/365 monitoring

-   Excludes scheduled maintenance (announced 48 hours in advance)

-   Measured per calendar month

-   Incident tracking with public status page

**I.2 What are your support response times?**

  Issue Severity                            Standard          Priority   Premium/TAM
  ----------------------------------------- ----------------- ---------- -------------
  **Critical** (system down)                24 hours          4 hours    1 hour
  **High** (major functionality impaired)   48 hours          8 hours    4 hours
  **Normal** (general questions)            5 business days   24 hours   8 hours

**Support channels:**

-   Standard: Email support only

-   Priority: Email + phone support

-   Premium/TAM: Email + phone + Slack/Teams, dedicated TAM

**I.3 Do you provide a dedicated Technical Account Manager (TAM)?**

☑ Yes (Enterprise tier only)

-   Dedicated TAM assigned at onboarding

-   Quarterly business reviews

-   Proactive platform optimization

-   Direct escalation path

-   Roadmap input sessions

**Section J: Contractual & Legal**

**J.1 Are you willing to negotiate an enterprise Master Services
Agreement (MSA)?**

☑ Yes (for Enterprise tier customers)

**Standard terms include:**

-   Liability caps

-   Indemnification provisions

-   Data ownership and rights

-   Termination rights

-   Service level commitments

-   Regulatory compliance obligations

**J.2 Can you accept customer paper (use customer\'s contract
template)?**

☐ Yes, with redlines for mutual agreement\
☑ Prefer Phase Mirror standard terms with customer addendum

-   Negotiation timeline: 2-3 weeks typical

-   Legal team contact:
    > [[legal\@phasemirror.io]{.underline}](mailto:legal@phasemirror.io)

**J.3 What are your standard liability limitations?**

-   **Liability cap:** 12 months\' fees paid by customer

-   **Exceptions:** Unlimited liability for:

    -   Gross negligence or willful misconduct

    -   Breach of confidentiality obligations

    -   IP indemnification

    -   Data breaches caused by Processor\'s breach (reasonable costs)

**Negotiable for Enterprise customers**

**J.4 Do you provide indemnification for data breaches?**

☑ Yes

-   Indemnification for breaches caused by Processor\'s failure to
    > comply with applicable data protection law

-   Covers: Regulatory fines, reasonable Data Subject notification
    > costs, reasonable legal fees

-   Subject to: Prompt notice, cooperation, control of defense

-   Cap: Per liability limitations (unless unlimited per exception)

**J.5 What is your termination notice period?**

-   **For convenience:** 30 days\' written notice (with pro-rated refund
    > of prepaid fees)

-   **For cause:** Immediate, upon material breach not cured within 30
    > days

-   **Data return:** Within 30 days of termination

-   **Assistance with transition:** Available (may be fee-based)

**J.6 Do you have Right-to-Audit clauses?**

☑ Yes

-   Frequency: Once per year + additional if reasonable grounds

-   Notice: 30 days (except breach investigations)

-   Scope: Compliance with DPA and Services Agreement

-   Cost: Customer bears auditor costs; Processor may charge for time
    > beyond 8 hours

-   Alternative: Acceptance of SOC 2 report in lieu of on-site audit

**3. CAIQ (CONSENSUS ASSESSMENTS INITIATIVE QUESTIONNAIRE) v4.0**

**Application & Interface Security**

**AIS-01: Are application and interface security standards based on
industry best practices?**

Yes. Phase Mirror implements OWASP Top 10 controls, secure SDLC
practices, and regular security testing. All APIs use OAuth 2.0 / JWT
authentication, input validation, output encoding, and CSRF protection.

**AIS-02: Are application and programming interfaces (APIs) designed and
tested according to industry standards?**

Yes. APIs designed per REST best practices, OpenAPI 3.0 specification.
Security testing includes:

-   Static Application Security Testing (SAST): Weekly scans

-   Dynamic Application Security Testing (DAST): Monthly scans

-   API penetration testing: Annually by third-party

-   Dependency scanning: Continuous (Snyk/Dependabot)

**AIS-03: Do you provide customers with documentation on secure use of
your services?**

Yes. Security best practices guide provided at onboarding, including:

-   Authentication configuration

-   Access control setup

-   Secure API usage

-   Monitoring and alerting setup

-   Security checklist for administrators

**Audit Assurance & Compliance**

**AAC-01: Do you have external audits performed at least annually?**

Yes. SOC 2 Type II audit conducted annually by \[Audit Firm\]. Most
recent audit: \[Date\]. Next audit: \[Date\].

**AAC-02: Do you have a process for maintaining compliance with
applicable regulatory requirements?**

Yes. Quarterly compliance reviews cover GDPR, CCPA, GLBA, SOX (where
applicable), and industry-specific requirements. Compliance program
managed by DPO with quarterly reporting to executive leadership.

**AAC-03: Are audit findings remediated in a timely manner?**

Yes. Remediation SLA:

-   Critical findings: 30 days

-   High findings: 60 days

-   Medium findings: 90 days

-   Low findings: Next release cycle

All findings tracked in GRC platform with executive visibility.

**Business Continuity Management & Operational Resilience**

**BCR-01: Do you have a documented Business Continuity Plan (BCP)?**

Yes. BCP includes:

-   Critical business functions identification

-   Recovery strategies for each function

-   Roles and responsibilities

-   Communication plans

-   Annual testing and validation

**BCR-02: Do you test your BCP/DRP at least annually?**

Yes. Full DR test conducted annually. Tabletop exercises conducted
semi-annually. Last full test: \[Date\]. Results: \[Summary\].

**BCR-03: Do you have defined RTO and RPO for critical services?**

Yes. See Section E.3 above (RTO: 4-24 hours, RPO: 1-24 hours depending
on tier).

**Change Control & Configuration Management**

**CCC-01: Do you have a documented change management policy?**

Yes. All changes follow formal change control process:

-   Change request submission

-   Risk assessment

-   Approval workflow (based on risk level)

-   Testing in non-production environment

-   Scheduled maintenance windows

-   Rollback procedures

-   Post-implementation review

**CCC-02: Do you notify customers of changes that may impact security or
availability?**

Yes. Notification procedures:

-   Major changes: 30 days advance notice

-   Urgent security patches: 24 hours notice (or immediate if critical)

-   Maintenance windows: 48 hours advance notice

-   Notification channels: Email + status page + in-platform alerts

**Data Security & Privacy**

**DSP-01: Do you classify data based on sensitivity?**

Yes. Data classification scheme:

-   **Public:** Marketing materials, public documentation

-   **Internal:** Business operations data, internal communications

-   **Confidential:** Customer data, proprietary information

-   **Restricted:** Special categories of personal data, financial data,
    > credentials

**DSP-02: Do you encrypt data at rest and in transit?**

Yes. AES-256 for data at rest, TLS 1.3 for data in transit. See Section
C.1 for details.

**DSP-03: Do you provide customers with the ability to export their
data?**

Yes. Customers can export data:

-   Platform: Via API or dashboard export (CSV, JSON formats)

-   Upon termination: Full data export provided within 30 days

-   Format: Structured, machine-readable formats

**DSP-04: Do you support data residency requirements?**

Yes. See Section C.4 - US-only, EU-only, and custom residency available.

**DSP-05: Do you have a data retention and disposal policy?**

Yes. See Section C.5 for retention periods. Disposal per NIST 800-88
guidelines with certification provided upon request.

**Human Resources Security**

**HRS-01: Do you conduct background checks on all employees with access
to customer data?**

Yes. See Section D.5 for details.

**HRS-02: Do employees receive security awareness training?**

Yes. Training program:

-   New hire security training: Within first week

-   Annual refresher training: All employees

-   Role-specific training: Personnel with data access receive
    > GDPR/privacy training

-   Phishing simulations: Quarterly

-   Tracking: Training completion tracked, non-completion escalated

**HRS-03: Do employees sign confidentiality agreements?**

Yes. All employees sign:

-   Confidentiality and Intellectual Property Agreement

-   Acceptable Use Policy acknowledgment

-   Code of Conduct acknowledgment

-   Annual re-certification required

**Identity & Access Management**

**IAM-01: Do you use multi-factor authentication (MFA)?**

Yes. MFA required for:

-   All user accounts (no exceptions)

-   Administrative access (no exceptions)

-   API access (optional but recommended)

-   VPN access (required)

-   SSO integration available (SAML 2.0)

**IAM-02: Do you implement least privilege access controls?**

Yes. See Section D.2 for access management procedures.

**IAM-03: How frequently are access rights reviewed?**

Quarterly. See Section D.3 for details.

**Infrastructure & Virtualization Security**

**IVS-01: Do you use industry-standard virtualization technologies?**

Yes. Infrastructure hosted on \[AWS/Azure/GCP\] using:

-   Industry-standard hypervisors (KVM, Xen, Hyper-V)

-   Container orchestration (Kubernetes)

-   Infrastructure as Code (Terraform)

-   Immutable infrastructure (no manual changes to production)

**IVS-02: Do you maintain network diagrams of your production
environment?**

Yes. Network architecture documentation maintained and reviewed
quarterly. Available to Enterprise customers under NDA.

**IVS-03: Do you implement network segmentation?**

Yes. Network segmentation includes:

-   Production isolated from corporate network

-   Customer data segregated (separate schemas/databases)

-   Management plane separated from data plane

-   DMZ for external-facing services

-   Microsegmentation with firewall rules

**Logging & Monitoring**

**LOG-01: Do you log security events?**

Yes. Comprehensive logging includes:

-   Authentication attempts (success and failure)

-   Authorization decisions

-   Data access

-   Configuration changes

-   Administrative actions

-   Network traffic (flow logs)

-   Application errors and exceptions

**LOG-02: How long do you retain logs?**

See Section G.4 for log retention periods (2-7 years depending on tier
and log type).

**LOG-03: Do you provide customers with access to logs related to their
data?**

Yes (Enterprise tier). Customers can access:

-   Audit logs via dashboard

-   API access logs

-   User activity logs

-   Export via API for SIEM integration

**LOG-04: Do you monitor logs for security events?**

Yes. 24/7 Security Operations Center (SOC) monitoring:

-   SIEM platform (Splunk/Sumo Logic/equivalent)

-   Automated alerting on suspicious activity

-   Threat intelligence integration

-   On-call security team

**Risk Management**

**RMG-01: Do you have a formal risk management program?**

Yes. Risk management program includes:

-   Annual enterprise risk assessment

-   Quarterly threat modeling for new features

-   Vendor risk assessments

-   Continuous vulnerability management

-   Risk register maintained with executive visibility

**RMG-02: Do you conduct risk assessments prior to implementing
changes?**

Yes. All changes undergo risk assessment:

-   Low risk: Team lead approval

-   Medium risk: Security review + manager approval

-   High risk: Security review + executive approval + change board

-   Critical risk: External review + CEO approval

**Security Incident Management**

**SIM-01: Do you have an Incident Response Plan?**

Yes. See Section B.8 for details.

**SIM-02: Do you conduct incident response exercises?**

Yes. Tabletop exercises conducted semi-annually. Last exercise:
\[Date\]. Participants: Security team, engineering leads, executive
team, legal, communications.

**SIM-03: What is your customer notification SLA for security
incidents?**

24 hours for material incidents. See Section B.9 for details.

**Supply Chain Management**

**SCM-01: Do you have a vendor risk management program?**

Yes. See Section F for details.

**SCM-02: Do you assess security of critical vendors?**

Yes. Annual security assessments of all vendors with data access. See
Section F.3 for assessment process.

**Threat & Vulnerability Management**

**TVM-01: Do you conduct vulnerability scans?**

Yes. Scanning program:

-   Weekly: Automated vulnerability scans (internal and external)

-   Monthly: Authenticated scans

-   Annually: Third-party penetration testing

-   Continuous: Dependency scanning

**TVM-02: What is your patch management process?**

Patch management SLA:

-   Critical patches: 7 days

-   High patches: 30 days

-   Medium patches: 60 days

-   Low patches: 90 days or next maintenance window

Emergency patches (zero-day): Immediate (within 24 hours)

**4. OCC THIRD-PARTY RISK ASSESSMENT**

**Risk Rating**

**Criticality to Operations:** \[High / Medium / Low\]

**Justification:** Phase Mirror provides AI governance infrastructure
for \[Customer\]\'s AI systems used in \[use case\]. Service criticality
is \[rationale\].

**Due Diligence Areas**

**1. Strategic Risks**

  Risk Factor               Assessment   Mitigation
  ------------------------- ------------ -----------------------------------------------------------------------------------
  **Business continuity**   Low-Medium   Documented BCP/DRP, tested annually, geo-redundant infrastructure
  **Concentration risk**    Low          Multi-cloud strategy, no single points of failure, alternative vendors identified
  **Reputational risk**     Low          No material adverse publicity, strong security posture, proactive compliance

**2. Compliance & Legal Risks**

  Risk Factor                 Assessment   Mitigation
  --------------------------- ------------ ----------------------------------------------------------------------------
  **Regulatory compliance**   Low          Compliant with GLBA, familiar with OCC guidance, annual compliance reviews
  **Contractual risks**       Low          Clear SLAs, right-to-audit, liability provisions, insurance coverage
  **Data protection**         Low          GDPR/CCPA compliant, DPA available, encryption at rest and in transit

**3. Operational Risks**

  Risk Factor               Assessment   Mitigation
  ------------------------- ------------ ------------------------------------------------------------------------
  **Service delivery**      Low          99.5-99.9% uptime SLA, 24/7 monitoring, incident response procedures
  **Change management**     Low          Formal change control, testing procedures, rollback capabilities
  **Capacity management**   Low          Auto-scaling infrastructure, capacity planning, performance monitoring

**4. Information Security Risks**

  Risk Factor             Assessment   Mitigation
  ----------------------- ------------ ----------------------------------------------------------------------------------
  **Data security**       Low          AES-256 encryption, TLS 1.3, SOC 2 Type II certified, annual penetration testing
  **Access controls**     Low          MFA required, RBAC, quarterly access reviews, privileged access management
  **Incident response**   Low          24-hour notification SLA, documented IRP, semi-annual testing

**5. Financial Risks**

  Risk Factor               Assessment   Mitigation
  ------------------------- ------------ ---------------------------------------------------------------------------
  **Financial stability**   Low          \[Profitable/adequate runway\], D&B rating \[rating\], insurance coverage
  **Vendor viability**      Low          Growing customer base, recurring revenue model, strong financials

**OCC Guidance Alignment**

**Compliance with OCC Bulletin 2013-29 (Third-Party Relationships):**

  OCC Expectation            Phase Mirror Compliance
  -------------------------- ------------------------------------------------------------------
  **Risk assessment**        Documented risk assessment available
  **Due diligence**          This package provides comprehensive due diligence materials
  **Contract structuring**   Right-to-audit, SLAs, termination rights, data return provisions
  **Ongoing monitoring**     Annual security reviews, SOC 2 audits, incident reporting
  **Termination rights**     30-day termination for convenience, immediate for cause

**5. SOC 2 TYPE II REPORT**

**Status:** Current (valid through \[Date\])

**Audit Period:** \[Start Date\] - \[End Date\]

**Audit Firm:** \[Firm Name\]

**Trust Services Criteria:**

-   ☑ Security

-   ☑ Availability

-   ☑ Processing Integrity

-   ☑ Confidentiality

-   ☐ Privacy (not in scope)

**Opinion:** \[Unqualified / Qualified\]

**Exceptions:** \[None / Number and nature of exceptions\]

**Availability:** Report available under NDA to qualified customers and
prospects. Request via:
[[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io)

**Bridge Letter:** Available if report is \>6 months old, confirming no
material changes since audit.

**6. FINANCIAL SERVICES ADDENDUM**

**Regulatory-Specific Information**

**SEC AI Disclosure Support**

Phase Mirror assists financial institutions in meeting SEC requirements
for material AI risk disclosure:[^[\[4\]]{.underline}^](#ohzezdihyx39)

-   **What we provide:** Governance gap analysis, risk identification,
    > documentation support

-   **What we don\'t provide:** Legal advice or guarantee of compliance

-   **Customer responsibility:** Final determination of materiality and
    > disclosure content

**Model Risk Management (SR 11-7 Alignment)**

Our platform supports Federal Reserve SR 11-7
guidance:[^[\[1\]]{.underline}^](#d43kwqsx3gjg)

  SR 11-7 Component       Phase Mirror Support
  ----------------------- ----------------------------------------------------------------------------------
  **Model Development**   Documentation of AI system design decisions and governance choices
  **Model Validation**    Dissonance Reports identifying gaps between stated governance and implementation
  **Model Use**           Tracking of production deployment and monitoring commitments
  **Model Governance**    Audit trails of policy decisions and approval workflows

**Fair Lending Compliance**

Financial Services Compliance Pack includes fair lending rules. When
processing data related to lending
AI:[^[\[1\]]{.underline}^](#d43kwqsx3gjg)

-   Phase Mirror does not make credit decisions

-   Dissonance Reports may identify potential fair lending risks

-   Reports are advisory, not determinative

-   Customer retains full responsibility for fair lending compliance

**GLBA Compliance**

Phase Mirror maintains safeguards consistent with GLBA Safeguards Rule:

  GLBA Requirement                  Phase Mirror Implementation
  --------------------------------- --------------------------------------------------------
  **Designated security officer**   CISO designated and qualified
  **Risk assessment**               Annual enterprise risk assessment
  **Safeguard design**              Controls per Annex II of DPA
  **Testing and monitoring**        Weekly vulnerability scans, annual penetration testing
  **Service provider oversight**    Vendor risk management program (Section F)
  **Program evaluation**            Annual SOC 2 audit, quarterly compliance reviews

**SOX Controls (for applicable customers)**

Phase Mirror can provide SOC 1 Type II report covering IT General
Controls (ITGCs) relevant to financial reporting:

-   Change management

-   Access controls

-   Computer operations

-   System development

**Available for:** Enterprise tier customers requiring SOX compliance
support\
**Contact:**
[[enterprise\@phasemirror.io]{.underline}](mailto:enterprise@phasemirror.io)

**Data Handling for Financial Services**

**Non-Public Personal Information (NPI)**

If customer provides NPI per GLBA definition:

-   Phase Mirror will not disclose to non-affiliated third parties
    > (except as permitted by GLBA)

-   NPI excluded from calibration data aggregation

-   Enhanced access controls applied

-   Additional logging and monitoring

**Financial Account Numbers**

If customer\'s AI systems process account numbers:

-   Phase Mirror recommends tokenization or masking before upload to
    > Platform

-   If full account numbers necessary, Enterprise tier required

-   Dedicated instance recommended

-   PCI DSS considerations (if payment cards involved)

**Material Non-Public Information (MNPI)**

Phase Mirror personnel are trained on MNPI handling. If customer
believes MNPI may be disclosed:

-   Customer should notify Phase Mirror in advance

-   Additional confidentiality measures applied

-   Trading restrictions implemented for relevant personnel

-   MNPI acknowledged in contract

**Examination Support**

**Regulatory Exam Support for Financial Services Customers**

Phase Mirror provides support during OCC, Federal Reserve, SEC, FINRA,
or state examiner reviews:

**Pre-Exam:**

-   Vendor due diligence package (this document)

-   Contract and SLA documentation

-   Security and compliance evidence

**During Exam:**

-   Coordination with customer\'s exam response team

-   Technical documentation as needed

-   Subject matter expert availability (within 48 hours)

-   Evidence packages prepared within 5 business days

**Post-Exam:**

-   Cooperation with remediation of any findings related to Phase Mirror

-   Implementation of additional controls if required

-   Documentation of remediation actions

**Contact:**
[[compliance\@phasemirror.io]{.underline}](mailto:compliance@phasemirror.io)

**7. SUPPORTING EVIDENCE LIBRARY**

**Available Documents (Request via
[[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io))**

**Security & Compliance:**

-   ☑ SOC 2 Type II Report (under NDA) - Most recent + prior year

-   ☑ SOC 1 Type II Report (if applicable, under NDA)

-   ☑ ISO 27001 Certificate (if applicable)

-   ☑ Penetration Test Summary Report (executive summary, not full
    > report)

-   ☑ Vulnerability Scan Sample Report (last 3 months)

-   ☑ Business Continuity Plan (executive summary)

-   ☑ Disaster Recovery Plan (executive summary)

-   ☑ Incident Response Plan (executive summary)

-   ☑ Information Security Policy (redacted)

-   ☑ Data Retention and Disposal Policy

-   ☑ Privacy Policy (public -
    > [[https://phasemirror.com/privacy]{.underline}](https://phasemirror.com/privacy))

**Contractual:**

-   ☑ Data Processing Agreement (DPA) template

-   ☑ Business Associate Agreement (BAA) template (for healthcare)

-   ☑ Standard Terms of Service

-   ☑ Service Level Agreement (SLA) details by tier

-   ☑ Master Services Agreement (MSA) template (Enterprise)

-   ☑ Professional Services Agreement template

**Insurance:**

-   ☑ Certificate of Insurance (Cyber Liability)

-   ☑ Certificate of Insurance (E&O)

-   ☑ Certificate of Insurance (General Liability)

**Financial:**

-   ☐ Audited Financial Statements (under NDA, if available)

-   ☑ D&B Business Information Report

-   ☑ Bank Reference Letter (if requested)

**Compliance:**

-   ☑ GDPR Compliance Summary

-   ☑ CCPA Compliance Summary

-   ☑ GLBA Safeguards Mapping

-   ☑ EU AI Act Compliance Summary (for customers using Compliance Pack)

-   ☑ Sub-processor List (current)

**Training:**

-   ☑ Security Awareness Training Curriculum (summary)

-   ☑ Employee Training Completion Statistics

-   ☑ Background Check Policy

**8. COMMON FINANCIAL SERVICES QUESTIONS**

**Q: Are you registered with FinCEN or subject to Bank Secrecy Act
(BSA)?**

No. Phase Mirror is a software provider and not a financial institution.
We do not hold, transfer, or process funds. We are not subject to FinCEN
registration or BSA requirements. Customers remain responsible for their
own BSA/AML compliance.

**Q: Do you have any investments or ownership by foreign entities?**

\[To be completed based on actual ownership structure - important for
CFIUS and national security considerations\]

**Q: Can you provide references from other financial services
customers?**

Yes. References available upon request (with customer permission).
Contact:
[[sales\@phasemirror.com]{.underline}](mailto:sales@phasemirror.com)

**Q: What happens if Phase Mirror is acquired or goes out of business?**

**Acquisition:**

-   30 days\' notice to customers

-   Continuation of service commitments

-   Right to terminate without penalty if acquirer materially changes
    > terms

**Business closure:**

-   90 days\' notice (if orderly wind-down)

-   Data return within 30 days

-   Source code escrow available (Enterprise tier)

-   Transition assistance provided

**Q: Do you maintain source code escrow?**

Yes, available for Enterprise tier customers. Escrow agent: \[Name\].
Release conditions: Bankruptcy, failure to support product for 90+ days,
material breach.

**Q: How do you handle government requests for customer data?**

-   Notify customer immediately (unless legally prohibited)

-   Challenge overbroad or unlawful requests

-   Provide minimum data necessary

-   Document all requests

-   Annual transparency report published

U.S. government requests comply with applicable law (ECPA, Stored
Communications Act, etc.).

**Q: Do you process payments or handle payment card data?**

No. Phase Mirror does not process payments or handle payment card data.
Payment processing is handled by third-party payment processor
\[Stripe/etc.\] who is PCI DSS Level 1 certified. Phase Mirror stores
only:

-   Customer billing contact information

-   Last 4 digits of payment method (for customer reference)

-   Payment history (dates and amounts, no full card numbers)

**Q: Can you support our bank\'s data classification scheme?**

Yes. Phase Mirror can accommodate custom data classification and tagging
requirements (Enterprise tier). Labels and metadata can be applied to
data within the Platform consistent with your classification scheme.

**Q: Do you have a bug bounty program?**

☑ Yes - Public bug bounty program via \[HackerOne/Bugcrowd/etc.\]\
☐ No - Private vulnerability reporting via
[[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io)

Responsible disclosure policy:
[[https://phasemirror.com/security]{.underline}](https://phasemirror.com/security)

**Q: What is your approach to open source software?**

-   All open source components inventoried and tracked

-   License compliance verified (no GPL in proprietary code)

-   Vulnerability scanning of all dependencies (Snyk/Dependabot)

-   Regular updates to address security issues

-   Open source component list available upon request

**Q: Can you support our segregation of duties (SOD) requirements?**

Yes. RBAC implementation supports SOD:

-   Separation of development, operations, and security roles

-   No single person has end-to-end access

-   Dual control for high-risk operations

-   Audit trails of all administrative actions

Custom SOD matrices can be implemented for Enterprise customers.

**9. ESCALATION & CONTACTS**

**Primary Contacts**

  Role                            Contact                                                                                      Response Time
  ------------------------------- -------------------------------------------------------------------------------------------- -----------------
  **Sales & General Inquiries**   [[sales\@phasemirror.io]{.underline}](mailto:sales@phasemirror.io)                           1 business day
  **Security Questions**          [[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io)                     2 business days
  **Compliance & Privacy**        [[dpo\@phasemirror.io]{.underline}](mailto:dpo@phasemirror.io)                               2 business days
  **Legal & Contracts**           [[legal\@phasemirror.io]{.underline}](mailto:legal@phasemirror.io)                           3 business days
  **Enterprise Solutions**        [[enterprise\@phasemirror.io]{.underline}](mailto:enterprise@phasemirror.io)                 1 business day
  **Security Incidents**          [[security-incident\@phasemirror.io]{.underline}](mailto:security-incident@phasemirror.io)   4 hours (24/7)

**Executive Escalation**

For urgent issues or escalations:

-   **CISO:** \[Name\] - \[Email\]

-   **CEO:** \[Name\] - \[Email\]

**10. PACKAGE VALIDITY & UPDATES**

**Version Control:**

-   Version: 2.0

-   Last Updated: January 2026

-   Next Update: July 2026 (or upon material change)

**Material Changes Triggering Update:**

-   New SOC 2 audit report

-   Change in subcontractors

-   Change in data locations

-   Significant security incidents

-   Regulatory enforcement actions

-   Material changes to services or security posture

**Requesting Updates:**\
Customers may request updated TPRM package at any time via:
[[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io)

**Notification of Changes:**\
Material changes will be communicated to existing customers within 30
days.

This Third-Party Risk Management Package provides comprehensive
responses to standard financial services vendor due diligence
requirements. For specific questions not addressed in this package,
please contact
[[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io).

Would you like me to create any additional components, such as:

-   A quick-reference scorecard version

-   An automated due diligence intake form

-   A comparison matrix against competitor offerings

-   Customized versions for specific regulators (OCC, Federal Reserve,
    > SEC)

-   An executive summary presentation deck

-   A vendor onboarding playbook for customers?

⁂

1.  Phase Mirror\_ Comprehensive Services Catalog.docx.pdf

2.  A Clear Guide to Phase Mirror\'s Services.pdf

3.  Agentic Domain-Specific Reasoning.pdf

4.  Phase Mirror\_ Consultation & SaaS.pdf

5.  Implementation Guide\_ Applying Phase Mirror Dissonance.pdf

6.  Phase mirror dissonance\_\_\_Open core must be useful.pdf

7.  License\_ Strategic & Legal Analysis.pdf

8.  Policy Memo\_ Managing Agentic AI Liability with the Phase Mirror
    > Framework.pdf

9.  The Phase Mirror does not resolve dissonance---it names it.pdf

10. Understanding Phase Mirror Dissonance\_ A Beginner\'s Guide.pdf

11. The Phase of Mirror Dissonance.pdf
