Vendor Security & Compliance Due Diligence Portal

Step 1: Corporate & Primary Contact Information

Provide basic company registration and primary security/technical contact details.

Legal Corporate Entity Name *

DBA / Trade Names

Corporate Website *

Corporate Phone Number *

Corporate Headquarters Street Address

City

State / Province

ZIP / Postal Code

Security / Compliance Lead Contact

Primary Contact Full Name *

Job Title

Email Address *

Direct Phone Number

Step 2: Data Classification & System Access (SEC Regulation S-P)

Identify the sensitivity of customer and firm data processed or accessed by your services.

Regulatory Note (SEC Reg S-P Safeguards Rule): First Heartland Capital is required by federal securities regulations to maintain stringent safeguards around consumer Non-Public Personal Information (NPI).

Scope of First Heartland Data Processed / Stored:

Non-Public Personal Information (NPI): Client SSNs, account balances, tax IDs, banking information, dates of birth.

Confidential Financial Records: Commission records, trading activity, internal communications, business financial data.

Public / Operational Data Only: Marketing metrics, public product data, no customer or internal financial records.

Network & System Connectivity Level *

Primary Cloud Hosting Infrastructure *

Data Residency Commitment *

Encryption Standards *

Step 3: Security Certifications & Incident Notification

Provide evidence of independent SOC 2 Type II examination, audit cycles, and breach notification SLAs.

SOC 2 Type II Audit Status *

SOC 2 Audit Period End Date (Coverage End)

The concluding date of your most recent SOC 2 Type II testing period.

Bridge / Gap Letter Execution Date

Required if your SOC 2 report testing period ended more than 12 months ago.

Security Breach Notification SLA *

Upload SOC 2 Type II Report or Bridge Letter (PDF format only, max 25MB):

Click to browse or select your SOC 2 Report

Only sanitized PDF files accepted (Maximum size 25MB)

Step 4: Artificial Intelligence (AI) & Machine Learning Governance

Mandatory disclosures regarding Large Language Model (LLM) usage, model training, and data custody.

First Heartland Capital AI Custody Mandate: In accordance with FINRA guidance and firm policy, customer non-public personal information (NPI) cannot be used to train foundational AI models without explicit zero-retention guarantees.

Does your platform or service incorporate Generative AI, LLMs, or autonomous algorithms? *

Yes (Platform employs AI / LLMs)

No (Standard non-AI software)

Step 5: 4th-Party Sub-Processors & Downstream Supply Chain

FINRA Regulatory Notice 21-29 requires full visibility into downstream service providers handling firm operations or customer data.

Critical Downstream Sub-Processors

Sub-Processor Name	Service Provided	Data Accessed	Location	DPA in Place	Action

Click "+ Add Sub-Processor" to catalog any downstream hosting, AI inference, database, or telephony vendors.

Step 6: Regulatory Undertakings & Electronic Certification

SEC Rule 17a-4 compliance undertakings and authorized corporate signature.

SEC Rule 17a-4(i) Cloud Undertaking on File *

SEC Regulation S-P Safeguards Agreement *

Electronic Certification & Attestation

By submitting this questionnaire, the undersigned officer certifies that they have the authority to bind the vendor and that all representations herein are truthful, accurate, and current.

Authorized Signer Name *

Title / Position *

Signer Corporate Email *

Attestation Date

I confirm and certify under penalty of perjury that all information provided in this questionnaire and attached documentation is true, accurate, and verifiable. *

Third-Party Vendor Intake Portal

Due Diligence Submission Received

Next Steps in the Review Process: