Trust and security

What happens to your data on a shop

A mystery shop produces evidence about your sales team and your competitors. Here is where that evidence goes, who sees it, and when it is deleted. If your procurement team needs more, ask.

Plain answers

What we collect.Your scoping brief, the competitors you name, the approved buyer profile, and the evidence gathered during the shop: emails, call notes, screenshots, quotes, and consented recordings where they exist. We do not ask for customer data, credentials, or system access.
Where it lives.Evidence and reports are stored in access-controlled cloud storage in the United States. Nothing is kept on shared drives or personal devices beyond the active working copy, which is deleted when the engagement closes.
Who can see it.The buyer running your shop and the person preparing your report. No one else. Access is per engagement and removed when the report is delivered.
Separation between clients.Each engagement has its own workspace. Findings about a vendor in your shop are never carried into another client's report, and findings about you in someone else's shop are never reported to anyone but them.
How long we keep it.Working evidence is retained for 12 months after the report so you can ask follow-up questions, then deleted. You can ask for earlier deletion at any time, and we confirm in writing when it is done.
If something goes wrong.If we become aware of unauthorized access to your data, we tell you within 72 hours of confirming it, with what was affected and what we did about it.
Subprocessors.Hosting and email delivery run on named third-party services. The current list is available on request and is included in the data processing addendum.
Recording.Calls are recorded only where every participant has agreed. Several US states require that, and we treat every call that way. Otherwise evidence is built from notes, emails, screenshots, and quotes.
Licensed data.Nothing from a mystery shop enters a licensed dataset unless the client has consented in writing. Competitors shopped in an evaluation never do. Every removal from a licensed record is logged.

Documents for procurement

W-9.Available now.
Engagement terms (MSA, SOW).Available for review before you sign. Currently being finalized with counsel; the working draft is shared on request.
Data processing addendum.Available on request, with the subprocessor list and the retention schedule above.
Client consent form.The form you sign so your own reps can be shopped and, where you choose, recorded.
Certificate of insurance.On request. Coverage details are confirmed in the engagement terms.
Security questionnaire.We complete your questionnaire, or share our answers to a standard one, within five business days.

What we don't have yet

We are a small firm and we would rather say so. We do not hold a SOC 2 report. Our engagement does not involve access to your systems, customer data, or credentials, which is why most reviews classify this work as low risk. If a SOC 2 report is a condition of a contract, tell us at scoping and we will discuss it.

Questions about any of this go to hello@vettedintel.com. See also the code of conduct and the privacy policy.

Send us your security questionnaire.

We return it within five business days, with the documents above attached.