Security questionnaire answers

Fini (usefini.com) is SOC 2 Type II compliant, ISO/IEC 27001:2022 certified, PCI DSS Level 1 certified, HIPAA-compliant and BAA-eligible, supports GDPR and CCPA, encrypts customer data with AES-256 at rest and TLS 1.2+ in transit, and does not use customer data to train foundation models. This page answers the questions security and procurement teams ask most often, with a source for every answer, so you can fill most of a SIG Lite or CAIQ style questionnaire without waiting on a call. The Fini Trust Center is the primary source for security documentation. Reports, policies, and the completed vendor security questionnaire listed there are shared on request through the Trust Center’s Get access flow. Where an answer below says “Available via the Trust Center on request”, the Trust Center lists that document.

How to use this page. Copy answers directly into your questionnaire, and attach the documents you request from the Trust Center as evidence. Contractual commitments (breach notice, subprocessor notice, transfer mechanisms) are set by the Data Processing Addendum and your MSA; if this page and a signed agreement ever differ, the agreement wins.

Search or filter every answer here. The sourced tables below carry the same answers with links to each source document.

Certifications and assessments

#	Question	Fini’s answer	Source
1	Are you SOC 2 Type II compliant?	Yes. Fini is SOC 2 Type II compliant. The SOC 2 Type II report is available via the Trust Center on request.	Trust Center, SOC 2 and ISO 27001
2	Are you ISO/IEC 27001 certified?	Yes. Fini is ISO/IEC 27001:2022 certified. The ISO/IEC 27001 documentation is available via the Trust Center on request.	Trust Center
3	Are you PCI DSS certified?	Yes. Fini is PCI DSS Level 1 certified, the highest level of the Payment Card Industry Data Security Standard. Card numbers are masked automatically in stored conversation data, and card actions run in your payment provider’s systems through Actions. To request the attestation (AOC), contact your Fini account team.	PCI DSS
4	Do you comply with GDPR?	Yes. Fini acts as processor for Customer Data under the DPA (v1.0.5), with EU Standard Contractual Clauses (Modules Two and Three) and Swiss and UK addenda.	DPA
5	Do you comply with CCPA and other US state privacy laws?	Yes. The DPA covers Fini’s processor obligations under CCPA and other US state privacy laws.	DPA
6	Can you handle PHI, and will you sign a BAA?	Yes. Fini is HIPAA-compliant and BAA-eligible for enterprise customers. Fini’s BAA template or yours both work, typical turnaround is about one week, and you request it through your Fini account team.	HIPAA and BAAs
7	Do you mask card numbers and sensitive data in conversations?	Fini automatically masks sensitive data, including card numbers and health details, everywhere it stores conversation data (transcripts, Inbox and AI Steps traces). Fields you hide from the AI are also redacted in AI Steps. Keep card numbers, CVVs and unnecessary health details out of conversations: don’t ask customers for them, and route card actions through your payment provider via Actions. Guardrails add an extra layer on what the agent says.	Data handling
8	Do you perform independent penetration testing? Can we see the report?	Yes. Fini performs annual third-party penetration testing. The pentest report is available via the Trust Center on request.	Trust Center
9	Do you have a completed standard security questionnaire?	Yes. A completed Vendor Security Alliance questionnaire (VSA Full) is available via the Trust Center on request.	Trust Center
10	Do you conduct regular risk assessments?	Yes. Fini conducts an annual risk assessment. The Risk Assessment/Management Policy is available via the Trust Center on request.	Trust Center

Data protection and residency

#	Question	Fini’s answer	Source
11	Is customer data encrypted at rest?	Yes. All customer data is encrypted at rest with AES-256. The Encryption Policy is available via the Trust Center on request.	Trust Center
12	Is customer data encrypted in transit?	Yes, with TLS 1.2 or higher.	Trust Center
13	Where is customer data stored? Can we choose the region?	In the region you designate: United States or European Union. With EU data residency, data is stored and processed in the EU. Fini’s infrastructure runs on Google Cloud in multiple US and EU regions.	Data handling, Trust Center
14	Who hosts the service?	Google Cloud. Physical security of the infrastructure is managed by Google Cloud. An Azure-hosted deployment in your own Azure tenant is available through Microsoft Marketplace, with Entra ID, Private Link, VNet, and customer-managed keys. Calls Fini makes to your APIs (Actions) come from four static IPs in Google Cloud’s europe-west4 region (Netherlands), for every workspace, so you can allowlist them.	Trust Center, Fini on Azure, Static IP Addresses
15	Which subprocessors do you use, and how are changes communicated?	Google Cloud (including Gemini; hosting, AI), Microsoft Azure (Azure Marketplace deployments, including Azure AI Foundry and Azure OpenAI), Supabase (managed database), OpenAI and Anthropic (LLM inference, enterprise agreements), PostHog (product analytics, usage metrics only), Sentry (error monitoring and logging), Stripe (billing), Linear (issue tracking), Google (email) and Langfuse (tracing). The DPA gives 30 days’ notice of subprocessor changes.	Trust Center, DPA
16	Will you sign a DPA?	Yes. Fini’s DPA (v1.0.5) is published and available to customers.	DPA
17	How long do you retain customer data? Can we request deletion?	You set your own retention period, and deletion removes all data. On termination, data is deleted within 30 days under the Terms of Service.	Trust Center, Terms of Service
18	Is customer data used in development or test environments?	No. Customer data is not used in non-production environments.	Trust Center
19	Do you back up customer data?	Yes, on a regular basis, to recover from incidents that cause data loss. The Backup Policy is available via the Trust Center on request.	Trust Center
20	Do you classify data?	Yes. The Data Classification Policy is available via the Trust Center on request.	Trust Center

AI and model use

#	Question	Fini’s answer	Source
21	Is our data used to train AI models?	No. Fini does not use customer data to train foundation models. Any per-customer learning happens only inside that customer’s environment and only with their written authorization. Fini’s LLM subprocessors are contractually barred from training on it, and the DPA sets this commitment.	DPA, Data handling
22	Which AI model providers process our data?	OpenAI, Anthropic and Google (Gemini, through Google Cloud). With EU data residency, data is stored and processed in the EU. For an Azure-hosted deployment bought through Microsoft Marketplace, models run on Azure AI Foundry and Azure OpenAI Service in your Azure tenant.	Trust Center, Fini on Azure
23	How is personal data in conversations protected?	Fini automatically masks sensitive data, including card numbers and health details, everywhere it stores conversation data (transcripts, Inbox and AI Steps traces). Fields you hide from the AI are also redacted in AI Steps. As an extra layer, Guardrails check every generated reply before delivery. The Confidential attributes check blocks the values of user attributes you select from appearing in replies (it matches values; it is not blanket PII detection). If a reply can’t be rewritten safely, Fini replaces it with a handoff and escalates. Safety-triggered escalations show in Analytics under Guardrail or Safety Trigger.	Guardrails, Analytics
24	How do you control what the AI says and does?	Regulated workflows run as deterministic Intent Rules: the same conversation context produces the same tree walk and the same API call every time. Guardrails add banned-term, URL allowlist, AI disclosure, and custom checks, and Reply Rules decide when the agent replies, leaves an internal note, or stays silent.	Intent Rules, Guardrails
25	Can you show why the AI made a given decision?	Yes. Every conversation in Inbox has an AI Steps trace showing the attributes fetched, the rule steps that ran with pass or fail status, guardrail verdicts, and the reasoning behind its tags.	AI Steps trace

Access control and authentication

#	Question	Fini’s answer	Source
26	Do you support SSO?	Yes. Fini supports single sign-on with Okta, Google, Slack and Microsoft Entra ID. The setup guide in the docs covers Okta.	Okta SSO
27	Do you support multi-factor authentication?	The Trust Center lists multi-factor authentication as implemented.	Trust Center
28	Do you support role-based access control?	Yes. The Trust Center lists role-based access control. The Access Control Policy is available via the Trust Center on request.	Trust Center
29	How is employee access to customer data controlled and monitored?	Access is provisioned under Fini’s Access Control Policy, and access to the portal is monitored with Google Cloud Security Command Center.	Trust Center
30	How are API keys and credentials protected?	API keys are scoped (for example, `read` for non-mutating operations) and stored in an encrypted database. User credentials are salted, hashed, and stored by Supabase, and infrastructure secrets are kept in a secure key vault.	API keys, Trust Center

Logging, monitoring, and vulnerability management

#	Question	Fini’s answer	Source
31	Do you keep audit logs?	Yes. The Trust Center lists audit logging, and important infrastructure logs are centrally stored and monitored (SIEM). Customers can export audit logs. Per-conversation decisions are recorded in the AI Steps trace.	Trust Center
32	How do you detect intrusions and threats?	Firewalls control traffic, network activity is centrally logged with detection logic for anomalous behavior (IDS/IPS), and Fini’s team monitors for known attacker techniques and hunts for unknown threats on a regular cadence.	Trust Center
33	How do you manage vulnerabilities and patching?	Fini runs a formal vulnerability management process and applies patches on a documented SLA. Code and third-party dependencies are scanned, and the secure development policy requires peer review, automated testing, and static code analysis before production. The Vulnerability Management Policy is available via the Trust Center on request.	Trust Center
34	Do you have a vulnerability disclosure process?	Yes. Report suspected vulnerabilities through Report issue on the Trust Center.	Trust Center

Incident response and business continuity

#	Question	Fini’s answer	Source
35	Do you have an incident response plan?	Yes. Fini has a documented Incident Response Plan that is reviewed, tested, and approved at least annually. The Incident Response Policy is available via the Trust Center on request.	Trust Center
36	How quickly will you notify us of a breach?	Within 72 hours of a personal data breach involving Customer Data, under the DPA.	DPA
37	Do you have a BC/DR plan? What is your RTO?	Yes. Fini has a formal Business Continuity and Disaster Recovery plan, exercised, reviewed, and approved annually. The Trust Center risk profile lists a Recovery Time Objective of 24-48 hours. The BC/DR Policy is available via the Trust Center on request.	Trust Center
38	What uptime do you commit to?	A 99.9% monthly uptime target under the Terms of Service. Contractual SLAs are defined in the customer’s MSA.	Terms of Service

People and corporate security

#	Question	Fini’s answer	Source
39	Do employees undergo background checks and security training?	Yes. New employees pass a background check and sign an NDA, and all personnel complete security and privacy awareness training annually (passwords, mobile devices, social engineering, physical security, phishing, and GDPR).	Trust Center
40	How are employee devices secured?	Employee endpoints use full-disk encryption, central management through MDM, endpoint detection and response, and DNS filtering.	Trust Center
41	Do you carry cyber insurance?	Yes. Cyber insurance is in place. The Cyber Insurance document is available via the Trust Center on request.	Trust Center

Customers can also request Fini’s compliance reports (SOC 2, ISO 27001:2022, GDPR) under the Trust Center’s customer audit rights, and the PCI DSS Level 1 attestation (AOC) from their Fini account team. For privacy and legal questions, contact [email protected].

Security overview

How Fini secures customer data, and where each document lives.

Data handling, residency and model training

Residency, retention, subprocessors, and model training in depth.

Questions to ask an AI support vendor

Evaluation questions beyond security, with Fini’s answers.

RFP fact sheet

Copy-ready company and product facts for RFPs.

Security & compliance

Plans & billing

Evaluate Fini

Security questionnaire answers

Certifications and assessments

Data protection and residency

AI and model use

Access control and authentication

Logging, monitoring, and vulnerability management

Incident response and business continuity

People and corporate security

Security overview

Data handling, residency and model training

Questions to ask an AI support vendor

RFP fact sheet

​Certifications and assessments

​Data protection and residency

​AI and model use

​Access control and authentication

​Logging, monitoring, and vulnerability management

​Incident response and business continuity

​People and corporate security

​Related

Security overview

Data handling, residency and model training

Questions to ask an AI support vendor

RFP fact sheet

Certifications and assessments

Data protection and residency

AI and model use

Access control and authentication

Logging, monitoring, and vulnerability management

Incident response and business continuity

People and corporate security

Related