For SaaS purchasers, IT leads and risk owners at smaller firms
Know what the security documents cover, and what they leave out.
Know what the security documents cover, and what they leave out.Your team received a SOC 2 report, trust-centre statements or a vendor security questionnaire that must be reviewed before access is granted.
A certificate headline or a SOC 2 cover page does not show whether controls cover your product, location, subcontractors and time period.
A real person scopes, researches, checks and signs off the evidence work. Technology assists; it does not approve findings.
The decision on your desk
Is the vendor’s available security evidence adequate for the intended data access?
Your small team must approve a vendor to process customer data, but has no spare capacity to map every document to the actual use case.
Reduce time spent reading vendor marketing instead of actual report scope.
Avoid assuming a control exists merely because a badge appears.
Give the security owner a short, factual exception list to resolve.
The actual work
What our people will examine for you.
Each line connects to a material question in your decision. We test what the record supports and what it does not, rather than producing a generic AI summary.
Attribute SOC 2 or equivalent reports to the correct legal entity, system and reporting period.
Locate stated exceptions, carve-outs, scope gaps and complementary user-entity controls.
Compare privacy, data-location, subprocessor and AI-processing statements with supplied documents.
Map up to twenty agreed control questions to actual evidence or missing material.
Identify material public incidents where relevant and distinguish dated facts from stale claims.
Deliver specific vendor follow-up requests and escalation triggers.
Your deliverables
A completed dossier your team can act on.
We turn the collected evidence into named findings, identified gaps and next actions. A human reviewer remains accountable for the scope, interpretation and release.
- Security evidence coverage table
- Critical gaps and open-control questions
- SOC 2 scope/exception reading notes, where supplied
- Dated vendor-source list
- Decision-focused escalation items for the qualified security owner
- Human-reviewed evidence memorandum
Complete 11-page example of report structure, evidence reasoning, calculations and limitations. The illustrated case is fictional, not a previous client assignment.
Low-friction engagement
Know the price. Send a short brief. Receive the acceptance terms in writing.
Tell us the decision
Send the name, your deadline and the 2–3 claims or records you need resolved. No phone call, budget questionnaire or data room on first contact.
A real person checks fit
We check conflict, legal permissions, sources and competence. You receive a written scope, start date and the fixed fee or a clearly explained change if your matter falls outside the published limits.
We deliver evidence you can inspect
Our people test the sources, check calculations, record contradictions and deliver the report. You receive one written clarification round within the agreed terms.
The standard review
One clear fee. No surprise expansion.
Included scope: One vendor, one product, one supplied SOC 2 or comparable assurance report and twenty buyer-selected control questions. No penetration testing, formal security attestation or legal compliance certification.
Timing: A documentary review timetable is agreed after permitted evidence access.
For regular users: Request a reusable written standard-scope arrangement. Each matter remains separately priced at its standard approved fee, with no automatic discounts or subscriptions.
Read the complete engagement boundaries and ordering process ↗Ready to proceed?
Request the Technology Vendor Security Evidence Review.
You're asking our team to confirm and accept this $2,450 standard bounded review. No payment is taken here. Your message reaches a person, not an automated research checkout.
If your email app does not open, write directly to info@apertureforensic.com with the service name and your decision question.
Before you send
Questions that matter to your purchase
Is the $2,450 fee fixed?
It is the proposed standard fee for the defined scope, pending final written commercial approval. We confirm the actual facts, jurisdiction, records, permitted work and final terms in writing before accepting it. We never add unapproved work to the bill.
Can I use my own AI system instead?
You can use AI for a preliminary review. What you commission here is human-directed independent source work, documented contrary-evidence testing, dated attribution, reviewed calculations and a defensible evidence handoff. If your internal process can already do that adequately, there may be no reason to buy this service.
Can you investigate a confidential matter?
Start with a short non-sensitive outline. A human reviewer confirms conflict checks, lawful source access, privacy safeguards and an appropriate transfer method before we receive confidential files.
Can my team use the review repeatedly?
Yes, subject to each matter being accepted. Repeat matters may use a reusable written scope and simpler onboarding, where appropriate. Each matter retains its standard approved fee and separate acceptance; no automatic discount or subscription applies.