EVI-206 acceptance fixture: parseable trust-center page for a fictional vendor (delete after acceptance)

evi206_fixture_trust_center.html

<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Northstar Data Systems — Security &amp; Trust Center (EVI-206 acceptance fixture)</title>
<style>
  body { font-family: sans-serif; max-width: 720px; margin: 2rem auto; }
  h1, h2 { color: #123; }
</style>
</head>
<body>
<script>
// Deliberate inline script payload: this block must NOT count as visible text.
// EVI-206's classify_body strips script/style blocks (content included) before the
// visible-text threshold. self.__next_f.push([1,"fixture-noise"]);
var __fixtureNoise = ["a","b","c","d","e","f"].join("-");
</script>
<h1>Security &amp; Trust at Northstar Data Systems</h1>
<p><em>This page is a test fixture for an automated acceptance run (EVI-206). Northstar
Data Systems is a fictional vendor.</em></p>

<h2>Information security policy</h2>
<p>Northstar Data Systems maintains a formal, documented information security policy.
The policy is approved by executive management and by the board risk committee, and the
current approved version is available to customers on request. The information security
policy is communicated to all employees and contractors during onboarding and through
mandatory annual security awareness training, and relevant excerpts are shared with
third parties and subprocessors as part of vendor agreements. The policy is reviewed
and updated at least annually, and additionally after any significant change to our
business, technology, or the threat landscape; the last review was completed in
January 2026. Roles and responsibilities for information security are defined in the
policy: our Chief Information Security Officer owns the security program, the Security
Steering Committee provides oversight, and every system owner carries documented
security responsibilities for the services they operate.</p>

<h2>Policy communication and awareness</h2>
<p>The information security policy is communicated to all relevant staff and to third
parties. Every employee and contractor receives the policy during onboarding, formally
acknowledges it in writing, and re-acknowledges it after every annual review. Relevant
policy excerpts are communicated to all third parties, suppliers, and subprocessors as
part of our vendor agreements, and completion of annual policy training is tracked for
all staff.</p>

<h2>Certifications and attestations</h2>
<p>Northstar Data Systems holds a current SOC 2 Type II attestation covering the
Security, Availability, and Confidentiality trust services criteria, and an
ISO/IEC 27001:2022 certificate for our information security management system. Reports
are available to customers under NDA through this trust center.</p>

<h2>Security practices</h2>
<p>All customer data is encrypted in transit using TLS 1.2 or higher and at rest using
AES-256. Multi-factor authentication is enforced for all employee access to production
systems. Access to customer data follows least-privilege and is reviewed quarterly.
We operate a 24x7 security monitoring capability and test our incident response plan
twice a year. Backups are taken daily, encrypted, and restore-tested every quarter.</p>

<h2>Subprocessors</h2>
<p>We use Amazon Web Services (AWS) for cloud infrastructure hosting and Datadog for
infrastructure monitoring. A complete, current subprocessor list is published on this
page and customers are notified thirty days before any change.</p>
</body>
</html>