A security review your InfoSec team can actually complete.
Enterprise buyers need clear answers about access, data handling and vendor risk. We provide a procurement pack, answer your questionnaire honestly and design each placement so assistants work inside your controls.
Our access model
ExecWing assistants work inside your systems, not ours. You create named accounts, set role-based permissions and enforce your own multi-factor authentication, single sign-on and device rules. That keeps your data under your existing controls and makes access easy to audit and remove.
We recommend least-privilege access from day one: start with the minimum each role needs, grant more only when a task requires it, and review access on a schedule. Offboarding follows a same-day checklist.
What the procurement pack includes
- Company information and legal entity details
- Our security overview and device and access policy
- Completed security questionnaire on request (your format or a standard one)
- Background-check approach for assistants, run with consent and where lawful
- Data-protection approach for each delivery country: the Philippines, Mexico and Colombia
- Master services agreement, order form and data processing addendum, available on request
- Business associate agreement for medical administrative roles, available on request
Where we are on certifications
ExecWing does not hold SOC 2 or ISO 27001 certification today, and we will not imply otherwise. SOC 2 readiness is on our roadmap. In the meantime, we draw on the NIST Cybersecurity Framework, answer questionnaires item by item and are clear when a control is yours, ours or shared.
If your vendor-risk policy requires an attestation we do not hold, tell us early. Many organizations address this by keeping assistants inside their own controlled environment with company-managed devices, which our optional equipment add-on can support.
How the review usually runs
We share the procurement pack after an NDA if you need one. Your security team sends its questionnaire, and we answer in writing. We then hold a working session to walk through access, devices, offboarding and incident reporting. Open items are tracked in a shared list until closed. Nothing starts until your team is satisfied with the controls for the pilot scope.
At a glance
- Assistants work in your accounts under your SSO and MFA
- Least-privilege access and same-day offboarding
- Questionnaires answered honestly, item by item
- No SOC 2 or ISO 27001 claimed; SOC 2 is on the roadmap
- Contracts and DPA available on request
Security review & procurement pack: questions
Will you sign our NDA?
In most cases, yes, alongside our standard confidentiality terms.
Can assistants use company-managed laptops?
Yes. Many enterprise programs require it. Our optional equipment add-on can source, configure, ship and recover devices to your standards.
Do you hold SOC 2?
No. SOC 2 is on our roadmap. We do not hold SOC 2 or ISO 27001 today.
Talk to us about your program.
Book an enterprise fit call or request a written proposal. Contracts and our procurement pack are available on request.