Security documentation & RFP guide
Compliance certifications, data handling controls, and structured guidance for enterprise teams running an RFP for AI training data services.
Security certifications and compliance documents
Corpshore AI holds the following certifications and is able to execute the following compliance agreements. All documents are available to enterprise procurement teams upon request.
SOC 2 Type II
Security, Confidentiality, Privacy Trust Services Criteria
Under NDA to qualifying enterprise teams
Full report includes audit period, controls tested, and any qualified opinions.
ISO 27001:2022
Information Security Management System (ISMS) for AI data operations
Certificate available on request; issuing body verifiable independently
Annual surveillance audits with three-year renewal cycle.
HIPAA BAA
Business Associate Agreement covering PHI handling in healthcare annotation programs
For qualifying healthcare AI programs
Covers annotation, QA, and delivery of PHI-involving data. Subprocessor list provided.
GDPR DPA
Data Processing Agreement with Standard Contractual Clauses (SCCs) for EU personal data
Standard template; jurisdiction-specific addendums available
UK GDPR addendum and Swiss-specific addendum available separately.
CCPA Service Provider Addendum
California Consumer Privacy Act service provider terms for California resident data
Standard template
CPRA updates incorporated.
To request documentation, contact info@corpshore.ai or use the enterprise contact form.
Data handling controls
Technical and administrative safeguards applied to all client data processed by Corpshore AI.
RFP structure guide
A structured RFP produces comparable vendor responses. The six sections below give AI data vendors the information they need to quote accurately.
Section 1: Program specification
Describe modality, task types, volume, language/dialect requirements, turnaround, output format, and integration requirements. Include 10 to 20 sample items so vendors can quote on comparable complexity.
Section 2: Workforce and delivery model
Ask whether annotators are direct employees, contractors, or crowd workers. Where they are located. First-language vs. second-language speaker ratio for language tasks. Annotator tenure on comparable programs.
Section 3: Quality architecture
Ask for the QA process step-by-step for your specific task type. IAA scores from comparable projects (distribution, not average). Escalation process for missed thresholds. Sample QA report from a comparable project.
Section 4: Security and compliance
Request: SOC 2 Type II under NDA, ISO 27001 certificate, applicable DPA/BAA, subprocessor list. Specify what regulatory overlays apply to your program (HIPAA, GDPR, CCPA, etc.).
Section 5: Pricing
Require a total cost breakdown for a worked example batch from Section 1. Per-unit rate, setup, QA (included or separate), rework policy, project management, and volume tiers. Ask for a reference contact from a comparable project.
Section 6: Evaluation criteria
State the weighting upfront: technical capability/workforce (35%), quality architecture (25%), security/compliance (20%), pricing (15%), project management (5%). Require a paid pilot as part of evaluation.
Full RFP guidance with worked examples is in the blog: How to write an RFP for AI training data services.
Frequently asked questions
- How do I request Corpshore AI's SOC 2 Type II report?
- Submit a request via info@corpshore.ai or through the enterprise contact form at corpshore.ai/enterprise. The report is provided under a standard mutual NDA to qualifying enterprise teams. Processing typically takes 48 to 72 business hours.
- Does Corpshore AI sign HIPAA BAAs?
- Yes. Corpshore AI signs HIPAA BAAs for qualifying healthcare AI annotation programs. The BAA covers annotation, QA, and delivery of PHI-involving data, and includes a subprocessor BAA provision. Request via the enterprise contact form.
- What data should I include in my RFP to Corpshore AI?
- Include: program description (modality, task types, volume estimate, language requirements), sample tasks (10 to 20 items), required certifications and compliance overlays, accuracy requirements, turnaround requirements, and output format. The more specific the program specification, the more accurate the quote.
- Does Corpshore AI offer paid pilots?
- Yes. Corpshore AI offers structured paid pilots of 500 to 2,000 items scoped to the client's actual program. The pilot covers task design, annotator calibration, QA, and delivery, and produces a quality report including IAA scores. Pilots typically run two to three weeks.
- What is Corpshore AI's standard delivery timeline?
- Standard delivery (first batch) is five to ten business days for programs up to 50,000 items, with production batches following the agreed cadence. Rush delivery (48 to 72 hours) is available for qualifying programs at an expedited rate. Contact the team for timeline specifics for your program volume.
- Where can I find Corpshore AI's subprocessor list?
- The subprocessor list is available to enterprise clients as part of the data processing agreement process. Request via info@corpshore.ai. The list is updated when subprocessors change, with 30 days advance notice to clients with active DPAs.
Ready to scope a pilot?
Tell us your modality, volume, and languages. We'll return an indicative scope, timeline, and cost band.