Admin-only intake copies for NPE Holding / HEA World. The return copy has answers and public evidence and no score — use that one to print a PDF. Public pages below are the customer-facing evidence linked from the questionnaire.
Principles, data residency, shared responsibility, compliance roadmap.
Core and connector processors, locations, and SCC notes.
Published Data Processing Agreement for HEA World customers.
Platform privacy notice, retention, and data-subject path.
Customer terms that sit with the DPA.
Public GDPR erasure request path.
Vulnerability contact: contact@hea-world.com and the Trust page.
15-minute probes of HEA services and provider status pages.
Public contact form used from Trust.
Claims, NIS2 Art. 21 rows, evidence, and gaps.
Access review and supplier-risk evidence fields.
Data categories, lawful basis, retention, and gaps.
Incident and vulnerability intake process.
Model-call / output failure ring and digest.
Status check, backup snapshot, model qualification, digest.
Auth coverage and endpoint inventory.