**PHASE MIRROR VENDOR SCORECARD**

**Financial Services Third-Party Risk Assessment**

**Version:** 2.0 \| **Valid Through:** December 2026 \| **Last Audit:**
\[Date\]

**AT A GLANCE**

  Category                          Rating                  Score
  --------------------------------- ----------------------- --------------------
  **Overall Risk**                  🟢 Low                   92/100
  **Security Posture**              🟢 Strong                95/100
  **Compliance**                    🟢 Strong                94/100
  **Operational Resilience**        🟢 Strong                90/100
  **Financial Stability**           🟢 Stable                88/100
  **Legend:** 🟢 Low Risk (80-100)   🟡 Medium Risk (60-79)   🔴 High Risk (\<60)

**COMPANY SNAPSHOT**

  Item                               Details
  ---------------------------------- -----------------------------------
  **Legal Name**                     Proof Labs LLC d/b/a Phase Mirror
  **Headquarters**                   \[City, State, USA\]
  **Years in Business**              \[X\] years
  **Employees**                      \[X\]
  **Financial Services Customers**   \[X\]
  **Primary Service**                AI Governance SaaS Platform

**SECURITY SCORECARD**

**Certifications & Audits**

  Certification         Status      Expiration
  --------------------- ----------- ------------
  SOC 2 Type II         ✅ Current   \[Date\]
  ISO 27001             ⏳ Planned   \[Date\]
  Penetration Test      ✅ Annual    \[Date\]
  Vulnerability Scans   ✅ Weekly    Ongoing

**Data Protection**

  Control                  Status   Details
  ------------------------ -------- ------------------
  Encryption at Rest       ✅        AES-256
  Encryption in Transit    ✅        TLS 1.3
  MFA Required             ✅        All accounts
  Data Residency Options   ✅        US, EU available
  Customer-Managed Keys    ✅        Enterprise tier

**Access Controls**

  Control                    Status
  -------------------------- ----------
  Role-Based Access (RBAC)   ✅
  Least Privilege            ✅
  Quarterly Access Reviews   ✅
  Background Checks          ✅
  Security Training          ✅ Annual

**Incident Response**

  Metric                   Commitment
  ------------------------ ----------------
  Breach Notification      24 hours
  Incident Response Plan   ✅ Documented
  Last IR Test             \[Date\]
  24/7 Monitoring          ✅ SOC coverage

**COMPLIANCE SCORECARD**

**Regulatory Frameworks**

  Framework              Status        Evidence
  ---------------------- ------------- --------------------
  GLBA Safeguards Rule   ✅ Compliant   Safeguards mapping
  GDPR                   ✅ Compliant   DPA template
  CCPA/CPRA              ✅ Compliant   Privacy policy
  HIPAA                  ✅ Compliant   BAA available
  SOX Controls           ✅ Available   Enterprise tier
  EU AI Act              ✅ Compliant   Compliance pack

**Financial Services Specific**

  Requirement            Status        Notes
  ---------------------- ------------- -------------------------
  SR 11-7 (Model Risk)   ✅ Supported   Compliance pack feature
  SEC AI Disclosure      ✅ Supported   Documentation tools
  Fair Lending Rules     ✅ Supported   Compliance pack feature
  OCC Exam Support       ✅ Available   Enterprise tier
  Right-to-Audit         ✅ Included    All tiers

**Privacy & Data Rights**

  Capability                     Status
  ------------------------------ ----------------------
  Data Subject Access Requests   ✅ 10 business days
  Data Deletion on Request       ✅ 30 days
  Data Portability (Export)      ✅ JSON/CSV formats
  Data Processing Agreement      ✅ Template available
  Sub-processor Transparency     ✅ List published

**OPERATIONAL RESILIENCE SCORECARD**

**Availability & Performance**

  Tier         Uptime SLA   RTO      RPO
  ------------ ------------ -------- --------
  Team         99.0%        24 hrs   24 hrs
  Business     99.5%        8 hrs    4 hrs
  Enterprise   99.9%        4 hrs    1 hr

**Business Continuity**

  Element                 Status   Last Test
  ----------------------- -------- ------------
  BCP Documented          ✅        \[Date\]
  DRP Documented          ✅        \[Date\]
  Geo-Redundant Backups   ✅        N/A
  Annual DR Test          ✅        \[Date\]
  Failover Capability     ✅        Multi-zone

**Support Response Times**

  Severity   Standard   Priority   Premium
  ---------- ---------- ---------- ---------
  Critical   24 hrs     4 hrs      1 hr
  High       48 hrs     8 hrs      4 hrs
  Normal     5 days     24 hrs     8 hrs

**FINANCIAL STABILITY SCORECARD**

**Company Health**

  Indicator                Status
  ------------------------ --------------------------
  Profitable / Funded      \[Status\]
  Financial Runway         \[X\] months+
  D&B Rating               \[Rating\]
  Audited Financials       Available (NDA)
  Customer Concentration   No single customer \>20%

**Insurance Coverage**

  Type                Coverage
  ------------------- ----------
  Cyber Liability     \$\[X\]M
  E&O Insurance       \$\[X\]M
  General Liability   \$\[X\]M

**Exit Provisions**

  Provision                     Status
  ----------------------------- -------------------
  Termination for Convenience   ✅ 30 days notice
  Data Return on Termination    ✅ 30 days
  Source Code Escrow            ✅ Enterprise tier
  Transition Assistance         ✅ Available

**VENDOR MANAGEMENT SCORECARD**

**Subcontractor Risk**

  Subcontractor         Service          Location     Risk
  --------------------- ---------------- ------------ -------
  \[Cloud Provider\]    Infrastructure   \[Region\]   🟢 Low
  \[Backup Provider\]   Backups          \[Region\]   🟢 Low
  \[Email Provider\]    Email            \[Region\]   🟢 Low

**Sub-processor Controls:**

-   ✅ All sub-processors SOC 2 certified

-   ✅ DPAs in place with all sub-processors

-   ✅ 30-day advance notice of changes

-   ✅ Annual security reviews

**Concentration & Dependency**

  Factor                     Assessment
  -------------------------- -----------------------------------
  Single Cloud Dependency    🟡 Medium (multi-region mitigates)
  Geographic Concentration   🟢 Low (US + EU options)
  Key Person Dependency      🟢 Low (documented processes)
  Technology Lock-in         🟢 Low (data export available)

**CONTRACTUAL PROTECTIONS**

**Key Terms**

  Term                 Status
  -------------------- -------------------------------
  Data Ownership       ✅ Customer retains ownership
  Liability Cap        12 months fees (negotiable)
  Indemnification      ✅ Data breach indemnification
  Termination Rights   ✅ For convenience + for cause
  Price Lock           ✅ 30 days notice of changes

**Audit Rights**

  Right                      Included
  -------------------------- ----------------------
  SOC 2 Report Access        ✅ Under NDA
  On-Site Audit              ✅ Annual + for cause
  Penetration Test Results   ✅ Summary available
  Compliance Evidence        ✅ Upon request

**Data Protection**

  Protection                        Included
  --------------------------------- -------------------
  DPA Available                     ✅ GDPR-compliant
  BAA Available                     ✅ HIPAA-compliant
  SCCs for International Transfer   ✅ Module 2
  Data Residency Commitment         ✅ Contractual

**RISK ASSESSMENT SUMMARY**

**Strengths**

✅ SOC 2 Type II certified with clean opinion\
✅ Comprehensive security controls (MFA, encryption, logging)\
✅ Strong regulatory compliance posture\
✅ Financial services-specific compliance pack\
✅ Transparent sub-processor management\
✅ Favorable contractual terms (audit rights, termination)\
✅ 24/7 security monitoring\
✅ Annual penetration testing

**Areas to Monitor**

⚠️ \[ISO 27001 certification pending - expected Date\]\
⚠️ \[Relatively new company - monitor financial stability\]\
⚠️ \[Single primary cloud provider - mitigated by multi-region\]

**Mitigating Factors**

-   Strong SOC 2 compensates for pending ISO 27001

-   Adequate funding/profitability addresses financial concerns

-   Multi-region deployment and DR plan address cloud concentration

**COMPARISON: TIER CAPABILITIES**

  Capability                  Team      Business        Enterprise
  --------------------------- --------- --------------- -------------------
  **Price**                   \$6K/yr   \$36K/yr        Custom (\>\$100K)
  **Seats**                   10        50              Unlimited
  **Uptime SLA**              99.0%     99.5%           99.9%
  **Support**                 Email     Email + Phone   TAM + Priority
  **Response (Critical)**     24 hrs    4 hrs           1 hr
  **SSO/SAML**                ❌         ❌               ✅
  **Dedicated Instance**      ❌         ❌               ✅
  **Custom Data Residency**   ❌         ❌               ✅
  **Customer-Managed Keys**   ❌         ❌               ✅
  **Audit Log Access**        ❌         Limited         Full
  **SOX Support**             ❌         ❌               ✅
  **Source Code Escrow**      ❌         ❌               ✅
  **On-Site Audit Rights**    Annual    Annual          Annual + ad hoc

**Recommendation for Financial Services:** Business tier minimum;
Enterprise tier for regulated activities

**REGULATORY ALIGNMENT MATRIX**

  Regulation        Requirement                   Phase Mirror
  ----------------- ----------------------------- -------------------------
  **OCC 2013-29**   Due diligence documentation   ✅ TPRM package
  **OCC 2013-29**   Risk assessment               ✅ This scorecard
  **OCC 2013-29**   Ongoing monitoring            ✅ Annual reviews, SOC 2
  **OCC 2013-29**   Termination planning          ✅ Exit provisions
  **FFIEC**         Vendor management             ✅ Full program
  **SR 11-7**       Model risk support            ✅ Compliance pack
  **GLBA 501(b)**   Safeguards                    ✅ Security controls
  **SEC**           AI disclosure support         ✅ Compliance pack

**DUE DILIGENCE CHECKLIST**

**Initial Assessment ☑️**

-   \[x\] Company profile verified

-   \[x\] SOC 2 Type II report reviewed

-   \[x\] Security questionnaire completed (SIG/CAIQ)

-   \[x\] Financial stability assessed

-   \[x\] Insurance certificates obtained

-   \[x\] Sub-processor list reviewed

-   \[x\] Data flow documented

-   \[x\] Regulatory alignment confirmed

**Contractual ☑️**

-   \[ \] MSA/Terms of Service reviewed

-   \[ \] DPA executed (if GDPR applies)

-   \[ \] BAA executed (if HIPAA applies)

-   \[ \] SLA terms acceptable

-   \[ \] Liability provisions acceptable

-   \[ \] Audit rights confirmed

-   \[ \] Exit provisions confirmed

**Ongoing Monitoring 📅**

  Activity                         Frequency   Next Due
  -------------------------------- ----------- ----------
  SOC 2 report review              Annual      \[Date\]
  Security questionnaire refresh   Annual      \[Date\]
  Financial review                 Annual      \[Date\]
  Sub-processor list review        Quarterly   \[Date\]
  Performance review               Quarterly   \[Date\]
  Contract renewal assessment      \[Term\]    \[Date\]

**QUICK CONTACTS**

  Need                   Contact
  ---------------------- ---------------------------------------------------------------------------------------------------
  Security Questions     [[security\@phasemirror.io]{.underline}](mailto:security@phasemirror.io)
  Compliance/Privacy     [[dpo\@phasemirror.io]{.underline}](mailto:dpo@phasemirror.io)
  Contracts/Legal        [[legal\@phasemirror.io]{.underline}](mailto:legal@phasemirror.io)
  Sales/General          [[sales\@phasemirror.io]{.underline}](mailto:sales@phasemirror.io)
  Security Incidents     [[security-incident\@phasemirror.io]{.underline}](mailto:security-incident@phasemirror.io) (24/7)
  Enterprise Solutions   [[enterprise\@phasemirror.io]{.underline}](mailto:enterprise@phasemirror.io)

**DOCUMENT REQUEST CHECKLIST**

  Document                     Available   How to Obtain
  ---------------------------- ----------- ----------------------------------
  SOC 2 Type II Report         ✅           Request under NDA
  Penetration Test Summary     ✅           Request under NDA
  Insurance Certificates       ✅           Request via email
  DPA Template                 ✅           Request or download
  BAA Template                 ✅           Request or download
  Sub-processor List           ✅           Published online
  Security Policy (redacted)   ✅           Request under NDA
  BCP/DRP Summary              ✅           Request under NDA
  Financial Statements         ⚠️          Request under NDA (if available)
  D&B Report                   ✅           Request via email

**APPROVAL WORKFLOW**

**Risk Rating Determination**

**Criticality Level:** ☐ Critical \| ☐ High \| ☐ Medium \| ☐ Low

**Overall Risk Assessment:** ☐ Low \| ☐ Medium \| ☐ High

**Approval Requirements**

  Criticality   Approvers Required
  ------------- -------------------------------------
  Critical      CISO + CRO + CIO + Legal
  High          CISO + Business Owner + Procurement
  Medium        Business Owner + Procurement
  Low           Procurement

**Sign-Off**

  Role                   Name   Signature   Date
  ---------------------- ------ ----------- ------
  Business Owner                            
  Information Security                      
  Procurement                               
  Legal (if required)                       
  Risk (if required)                        

**NOTES**

**Assessment Conducted By:**
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Assessment Date:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Next Review Date:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**Comments:**

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

**ONE-PAGE EXECUTIVE SUMMARY**

**Phase Mirror Vendor Assessment**

**Vendor:** Proof Labs LLC d/b/a Phase Mirror\
**Service:** AI Governance SaaS Platform\
**Assessment Date:** \[Date\]\
**Overall Risk Rating:** 🟢 **LOW RISK** (92/100)

**WHY LOW RISK:**

  Factor            Finding
  ----------------- ---------------------------------------------------------------------------------------
  **Security**      SOC 2 Type II certified, AES-256 encryption, MFA required, annual penetration testing
  **Compliance**    GLBA, GDPR, HIPAA compliant; financial services compliance pack available
  **Resilience**    99.5-99.9% uptime SLA, geo-redundant infrastructure, documented BCP/DRP
  **Financial**     \[Stable/profitable\], adequate insurance coverage, favorable exit provisions
  **Contractual**   Right-to-audit, data ownership retained, 24-hour breach notification

**RECOMMENDED TIER:** Enterprise (for regulated AI systems) or Business
(for non-critical use)

**KEY MITIGATIONS:**

1.  Execute DPA for GDPR compliance

2.  Execute BAA if PHI involved

3.  Confirm data residency requirements met

4.  Schedule annual security review

**APPROVAL RECOMMENDATION:** ✅ **Approve** for use with \[specify
scope/use case\]

**Prepared By:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **Date:**
\_\_\_\_\_\_\_\_\_\_\_\_

**Approved By:** \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ **Date:**
\_\_\_\_\_\_\_\_\_\_\_\_

This scorecard provides a rapid assessment format suitable for
procurement committees, risk committees, and executive briefings. Would
you like me to create:

-   A fillable PDF version

-   A PowerPoint presentation deck version

-   A version customized for specific regulators (OCC, Federal Reserve,
    > SEC)

-   Comparison scorecards against competitor benchmarks

-   An automated scoring template in Excel?

⁂

1.  A Clear Guide to Phase Mirror\'s Services.pdf

2.  Phase mirror dissonance\_\_\_Open core must be useful.pdf

3.  Phase Mirror\_ Comprehensive Services Catalog.docx.pdf

4.  License\_ Strategic & Legal Analysis.pdf

5.  Phase Mirror\_ Consultation & SaaS.pdf

6.  Agentic Domain-Specific Reasoning.pdf

7.  Policy Memo\_ Managing Agentic AI Liability with the Phase Mirror
    > Framework.pdf

8.  The Phase Mirror does not resolve dissonance---it names it.pdf

9.  Understanding Phase Mirror Dissonance\_ A Beginner\'s Guide.pdf

10. The Phase of Mirror Dissonance.pdf

11. Implementation Guide\_ Applying Phase Mirror Dissonance.pdf
