Mandate — Legal & Security

v0.1 procurement pack · updated 2026-05-15

Mandate is a sales-intelligence and pipeline tool for trustee, escrow, loan-agency, and paying-agent firms. The documents below are the procurement-relevant materials. Drafts pending lawyer review; signed copies provided on request before paid-pilot countersignature.

Privacy & data protection

Privacy Notice

Who we are, what personal data we process, why, who we share it with, retention, your rights, and contact for data-subject requests.

UK GDPR / EU GDPR Articles 13 & 14 · v0.1

Data Processing Agreement

Article 28 GDPR processor terms. Subject matter, security measures, sub-processor authorisation, breach notification, audit rights, deletion at termination.

UK GDPR / EU GDPR Article 28 · SCCs 2021/914 · UK IDTA · v0.1

Sub-Processor List

Current sub-processors with role, region, data accessed, and contract reference. 30-day notification on changes; Customer right to object.

v0.1 · updated on each sub-processor change

Legitimate Interest Assessment

Article 6(1)(f) balancing test for processing public professional contact data of named partners, bank desks, and sponsor team contacts. Available on request.

v0.1 (in preparation)

Security

Security Overview

One-page summary of access control, encryption, audit, source discipline, sub-processors, and the honest list of what we don’t hold yet (SOC 2 Type II, ISO 27001, etc.).

v0.1

Vendor Security Questionnaire

Pre-answered VSQ across organisation, hosting, data classification, access control, SDLC, vulnerability management, BCP, IR, compliance, data subject rights, sub-processors, and service availability.

v0.1 · aligned with common buyer questionnaires

Incident Response Plan

Severity tiers (P0–P3) with response times, runbooks for common scenarios, customer notification template, regulator notification path, post-mortem requirement.

UK GDPR Articles 33–34 · ISO 27035 spirit · v0.1

Operations

Architecture Analysis

Current system, strengths, weaknesses with severity, P0 production hardening checklist, 90-day and 12-month target architectures with diagrams, full feature roadmap, frontend tech-debt audit.

v0.1

Path to Production

Four-phase plan to paid-pilot readiness: hardening, build, procurement pack, operational. Timeline ~14 calendar days.

v0.1

Requesting full text or signed copies

Procurement teams: send the questionnaire to the address below. Mandate returns the answer pack plus signed DPA, sub-processor list, privacy notice, and security overview. Add-on documents (pen-test summary, BCP/DR plan, SOC 2 Type I report when available) on request.

Contact: (insert privacy / security contact email before paid-pilot signature)

← Back to Mandate