n_companies: 34
n_contacts: 52
company_missing: industry=0; employee_count=9; hq_country=6
invalid_email_count: 4
invalid_emails: CT-0010, CT-0080, CT-0081, CT-0192
domain_mismatch_count: 1
domain_mismatches: CT-0011
duplicate_clusters: ['C-0A092931', 'C-0A092932'], ['C-0A092933', 'C-0A092934']
n_dup_clusters: 2
enrichment_matches: 25
graded checks: dup_clusters · invalid_emails · survivor_language · completeness_pct · no_invent

Model's actual answer

show the model's full answer

Here is the complete audit.

---

## SECTION 1: FIELD COMPLETENESS PER FIELD

### DEALS
**No file provided.** Required fields (owner, stage, amount, close_date, why_buys) — all 0% populated. Cannot audit pipeline.

### COMPANIES (n = 34)

| Field            | Populated | %       |
|------------------|-----------|---------|
| industry         | 34 / 34   | 100.0%  |
| employee_count   | 25 / 34   | 73.5%   |
| hq_country       | 28 / 34   | 82.4%   |

Industry looks filled but the *values* are dirty: "tech", "tech ", "Tech ", "Technology", "health care", "Healthcare", "SaaS" all appear for what should be 2–3 standardised labels. That's a 100% completeness rate masking poor data quality.

### CONTACTS (n = 52)

| Field            | Populated | %       |
|------------------|-----------|---------|
| email            | 52 / 52   | 100.0%  |
| title            | 39 / 52   | 75.0%   |
| persona          | 37 / 52   | 71.2%   |
| all three        | 30 / 52   | 57.7%   |

Email is "100%" but 4 of those 52 are syntactically invalid (see Section 3).

---

## SECTION 2: DUPLICATE COMPANY CLUSTERS

### Cluster 1 — acme-corp.com (2 records)
| Alias         | Industry    | Emp | HQ      |
|---------------|-------------|-----|---------|
| C-0A092931    | Technology  | 500 | US      |
| C-0A092932    | tech        | 510 | USA     |

Industry also disagrees (Technology vs tech), employee count differs by 10, HQ country differs (US vs USA — same country, different spelling).

**Survivor: C-0A092931** (neutral industry spelling "Technology", ties otherwise — arbitrary pick, merge C-0A092932's 510 employees if verified).

### Cluster 2 — globex.io (2 records)
| Alias         | Industry    | Emp | HQ      |
|---------------|-------------|-----|---------|
| C-0A092933    | SaaS        | 200 | US      |
| C-0A092934    | Technology  | 200 | US      |

Industry disagrees (SaaS vs Technology). Employees match (200). HQ matches (US).

**Survivor: C-0A092933** (arbitrary; standardise industry to "Technology" or keep "SaaS" depending on your vertical taxonomy).

---

## SECTION 3: INVALID EMAILS & DOMAIN MISMATCHES

### Truly invalid emails (n = 4)
| Contact     | Company    | Raw value     | Issue                          |
|-------------|------------|---------------|--------------------------------|
| CT-0010     | C-66D1FC   | `user0@`      | No domain after @              |
| CT-0080     | C-92D97D   | `user0@`      | No domain after @              |
| CT-0081     | C-92D97D   | `user1@`      | No domain after @              |
| CT-0192     | C-425E2A   | `user2@`      | No domain after @              |

### Domain mismatches (n = 1)
| Contact     | Company    | Email                           | Issue                                          |
|-------------|------------|----------------------------------|------------------------------------------------|
| CT-0011     | C-66D1FC   | `user1@other-domain.com`        | Email domain "other-domain.com" != company domain "66d1fc.com". Likely copy-paste or personal email. |

---

## SECTION 4: FILL MISSING COMPANY FIELDS FROM ENRICHMENT

### Missing CRM fields filled from enrichment (n = 8 fills)

All 8 are **employee_count** — CRM has blank, enrichment has a number:

| Company                | Domain        | Field Filled         | Zoominfo Value |
|------------------------|---------------|----------------------|----------------|
| C-EC3025               | ec3025.com    | employee_count       | 400            |
| C-96039F               | 96039f.com    | employee_count       | 400            |
| C-44EA29               | 44ea29.com    | employee_count       | 400            |
| C-D04904               | d04904.com    | employee_count       | 400            |
| C-B23205               | b23205.com    | employee_count       | 400            |
| C-60C75F               | 60c75f.com    | employee_count       | 400            |
| C-7BBDFA               | 7bbdfa.com    | employee_count       | 400            |
| C-50D386               | 50d386.com    | employee_count       | 400            |

**CRM blank HQ countries that enrichment also leaves blank (no fill possible):**
C-2D1F1B (2d1f1b.com), C-D73B89 (d73b89.com), C-44EA29 (44ea29.com), C-D04904 (d04904.com), C-2C60E5 (2c60e5.com) — enrichment has no HQ data either.

### Companies with NO enrichment row (n = 9 rows, 7 unique domains)
C-BA969B (ba969b.com), C-332637 (332637.com), C-93C8BF (93c8bf.com), C-EE9FFB (ee9ffb.com), C-C9BB20 (c9bb20.com), C-0A092931 / C-0A092932 (acme-corp.com), C-0A092933 / C-0A092934 (globex.io) — enrichment export does not contain these domains at all.

### CRM vs enrichment disagreements (1 meaningful, after normalising US/USA/United States aliasing)

| Company     | Domain        | Field     | CRM Value  | Zoominfo Value     | Recommendation               |
|-------------|---------------|-----------|------------|--------------------|------------------------------|
| C-425E2A    | 425e2a.com    | industry  | "Tech "    | "Computer Software" | Adopt "Computer Software" (verified enrichment source) |

Note: The many "Technology" vs "Computer Software" and "US"/"USA"/"United States" differences across 17 other CRM rows are aliasing/casing issues, not substantive disagreements. Treat as data normalisation tasks.

---

## SECTION 5: TOP 10 FIXES BY PIPELINE AMOUNT AT STAKE

**Cannot compute — no deals file was provided.**

The three supplied files (companies.csv, contacts.csv, zoominfo_enrichment.csv) contain zero pipeline data. There are no deal records, no amounts, no close dates, no owner names, no stage values — nothing to rank by.

To produce the top-10-pipeline-impact fix list, please supply a **deals.csv** with at minimum:
```
deal_id, company_alias, owner, stage, amount, close_date, why_buys
```

Once that arrives, I'll cross-reference every fix above against deal amounts and deliver the ranked list.

## Product Gap Analysis — Bonusly Active Deals

**Note:** The provided data contains no deal-amount column. I can name the deal aliases and classify each candidate, but cannot report dollar amounts — they aren't in the source.

---

### Candidate 1 — TG-001 / Deal-EC3025

**Prospect line:** *"We need SCIM user provisioning — our security team will not approve any tool that requires manual account management."*

**Classification:** **REAL GAP**

**Docs excerpt:** *"SCIM user provisioning... NOT currently listed as supported capabilities."*

SCIM doesn't exist at any tier. This is a missing feature, not a paywall or training failure. The prospect has drawn a hard line — their security team rejects manual management entirely. No upgrade or enablement session can close this; it requires a build-or-partner decision.

---

### Candidate 2 — TG-002 / Deal-D0D6B5

**Prospect line:** *"Our payroll runs on ADP Workforce Now and I don't see ADP anywhere in your integration list — that's a dealbreaker for us."*

**Classification:** **REAL GAP**

**Docs excerpt:** *"ADP Workforce Now... NOT currently listed as supported capabilities."*

ADP is absent entirely. The prospect explicitly called it a dealbreaker. Like SCIM, this isn't a tier lock or a rollout problem — the integration simply doesn't exist.

---

### Candidate 3 — TG-003 / Deal-CFE7F4

**Prospect line:** *"I tried to build a custom report combining recognition frequency with turnover and couldn't — is that possible on our current plan?"*

**Classification:** **PLAN GATE**

**Docs excerpt:** *"Custom report builder — Enterprise tier only."*

The feature exists. The prospect is on a lower tier (Core or Pro, per the plan table where custom reports show as Enterprise-only). This is an upsell conversation, not a product gap. The prospect is asking about their plan, not reporting a missing capability.

---

### Candidate 4 — TG-004 / Deal-84DBA6

**Prospect line:** *"We turned on the Slack integration in July, but half our managers still haven't given a single recognition — nobody ever trained them on it."*

**Classification:** **ROLLOUT / ENABLEMENT ISSUE**

**Docs excerpt:** Slack integration is listed as available on all plans. The feature works. The problem is adoption — managers were never trained. Alex offered a enablement session, which is the correct response. Zero product gap.

---

### Candidate 5 — TG-005 / Deal-36C33F

**Prospect line (from HR Manager):** *"Good to know. The web version should be fine for our office staff for now."*

**Classification:** **NOT A GAP — rep-raised concern dismissed by prospect**

**Why excluded:** The limitation ("no native mobile app") was **raised by Alex Franklin (the rep)**, not the prospect. Per the rules: *"Rep language does not count as prospect voice."* The prospect's response was acceptance — they explicitly said the web version is fine. No prospect-proxy gap exists here.

---

## Summary — True Product Gaps

| Deal | Gap | Prospect | Priority Signal |
|---|---|---|---|
| **Deal-EC3025** | SCIM user provisioning not supported | IT Security Lead | "our security team will not approve" — hard blocker |
| **Deal-D0D6B5** | ADP Workforce Now not in integration list | HRIS Manager | "that's a dealbreaker for us" — explicit churn risk |

**No other candidates qualify.** The other three are a plan gate (TG-003), an enablement issue (TG-004), and a rep-raised concern the prospect accepted (TG-005). Only SCIM and ADP are genuine missing features blocking revenue.

show the model's full answer

## Analysis of Alex Franklin — Last 10 Calls (2026-07-28 to 2026-09-03)

---

### 1. What they lead with in the first five minutes

**8 of 10 calls** use the same script:

> "Quick one to kick off: a 400-person retailer we work with cut regretted turnover 18% in two quarters after automating milestone awards, and I wanted to walk you through exactly how they did it."
> — Alex Franklin, TT-001/002/003/005/006/007/008/010, min 0

**2 calls deviate:**

- TT-004: *"I put together a short agenda — security review first, then pricing."* (no case study, no value hook)
- TT-009: *"You asked for straight pricing last time, so let's start there."* (reacting to a prior request, no value hook)

---

### 2. How they handle the three most common objections

#### Objection A — Budget locked (4 times: TT-001, TT-003, TT-006, TT-010)

> "Honestly, budget is locked until next fiscal year — I can't add a new line item right now."
> — Prospect in TT-001/003/006/010, min 6

**Alex's response (identical all 4 times):**

> "Totally fair. Most teams fund this out of turnover savings — that retailer saved about $210k in avoided backfills, which is how their finance team signed off."
> — Alex Franklin, min 8

**Results:** This saved 3 of 4 deals (next step agreed in TT-001, TT-003, TT-006). In TT-010, the prospect followed up with *"We'll have to wait for the committee — I can't commit to anything today"* and Alex accepted it without a countermove.

#### Objection B — Time pressure / "revisit next quarter" (3 times: TT-002, TT-005, TT-008)

> "This is good, but can we revisit it next quarter? Open enrollment starts in October and we're underwater."
> — Prospect in TT-002/005/008, min 6

**Alex's response (identical all 3 times):**

> "Makes sense. What if we scope a 90-day pilot with one department so you have internal data before next quarter's planning?"
> — Alex Franklin, min 8

**Results:** 3/3 converted to a next step. This is the strongest objection-handle pattern in the dataset.

#### Objection C — "Why change from spreadsheets?" (3 times: TT-004, TT-007, TT-009)

> "We already do recognition with a spreadsheet and quarterly gift cards — why would we change?"
> — Prospect in TT-004/007/009, min 6

**Alex's response (identical all 3 times):**

> "Spreadsheets work until they scale — the difference is automation: milestones fire without HR lifting a finger, and you get analytics on who is being recognized."
> — Alex Franklin, min 8

**Results:** 1/3 converted to a next step (TT-009). TT-004 and TT-007 both ended with no commitment — Alex didn't push past the prospect's second deferral.

---

### 3. Concrete next step agreed rate

**7 of 10 calls** closed with a concrete next step.

Calls with a next step agreed: **TT-001, TT-002, TT-003, TT-005, TT-006, TT-008, TT-009** (7)

Calls with no next step: **TT-004, TT-007, TT-010** (3)

**Rate = 7/10 = 70%**

Notably: Alex asked for the next step in exactly 7 calls and closed 7/7 (100% when he asks). In the 3 calls he lost, he never asked — he accepted the deferral directly.

---

### 4. Every competitor a prospect raised

| Competitor | Call | Line |
|---|---|---|
| **Awardco** | TT-003 (min 4) | *"We're also in late talks with Awardco — their rewards catalog looks bigger than yours."* |
| **Kudos** | TT-007 (min 4) | *"How are you different from Kudos? Our CEO used them at her last company."* |

Alex also *proactively* name-dropped **Workhuman** in TT-005 (min 2: *"And unlike Workhuman, our pricing includes the full rewards catalog with no extra margin."*) — but that was his own framing, not a prospect raising it.

---

### 5. Coaching notes

**Note 1 — Stop accepting the second deferral.** Alex handles the first objection well, but when a prospect follows up with a soft deferral ("I need to think about it," "wait for the committee," "can't commit today"), he drops his pipeline and says "Fair enough" or "Understood" without even asking for the next step. In all 3 such cases (TT-004, TT-007, TT-010), the deal went cold. A second-layer move — e.g. "What if we set a 15-min call for when the committee meets next?" — would give those deals a path forward instead of dead-ending them.

**Note 2 — Stick to the opening script.** Calls that opened with the retailer proof point (8 of 10) had a 7/8 next-step rate (87.5%). The two calls that deviated (TT-004: "security review first"; TT-009: "straight pricing") both opened without a value hook — TT-009 recovered thanks to the objection handle, but TT-004 never regained momentum. The retailer story does two things the alternates don't: it establishes social proof in the first line and names a quantified outcome (18% reduction, $210k savings) that directly funds every objection that follows. Don't ditch it unless you have a stronger proof point ready.

**Last completed month: August 2026 (2026-08)**

**Redemption Count:** 48
**Total Spend:** $3,536.00
**Unique Redeemers:** 46
**Redemptions per Redeemer:** 1.04

**Provider Mix (% of Spend):**

| Provider | Spend | Share |
|---|---|---|
| Tremendous | $1,145.00 | 32.4% |
| custom | $1,057.00 | 29.9% |
| Snappy | $834.00 | 23.6% |
| TangoCard | $500.00 | 14.1% |
| **Total** | **$3,536.00** | **100.0%** |

**Top 5 Countries by Redemption Count:**

1. US — 31
2. CA — 7
3. GB — 2
4. SG — 2
5. AU — 2

*(NL also had 2 redemptions, tied for 3rd with GB/SG/AU)*

**Arithmetic verification:**

- 500 + 1,145 + 1,057 + 834 = 3,536
- TangoCard: 500/3,536 = 14.14% -> 14.1%
- Tremendous: 1,145/3,536 = 32.38% -> 32.4%
- custom: 1,057/3,536 = 29.89% -> 29.9%
- Snappy: 834/3,536 = 23.59% -> 23.6%
- Sum: 14.1 + 32.4 + 29.9 + 23.6 = 100.0%

Here is the quarter's ticket synthesis ranked by ARR exposure (distinct-account ARR sum = **$284,800** total).

---

## 1. HRIS provisioning failures
**Count:** 12 tickets | **Share of ARR exposure:** 40.0% | **Distinct accounts:** 3 | **ARR affected:** $114,000

- C-0B2213A9 — $36,000 (7 tickets)
- C-0DDFC9A7 — $48,000 (3 tickets)
- C-0F6C0F34 — $30,000 (2 tickets)

**Sample tickets:** IC-460062 ($30k — "HRIS sync skipped 12 new hires; provisioning log shows no errors"), IC-460059 ($36k — "HRIS provisioning is not creating accounts for new hires this month")

**Recommendation:** The HRIS sync silently skips records (no error logged). Investigate the connector's delta-filter logic and add explicit per-record success/failure logging; new-hire provisioning is a critical onboarding path.

---

## 2. Redemption / checkout failures
**Count:** 18 tickets | **Share of ARR exposure:** 24.2% | **Distinct accounts:** 7 | **ARR affected:** $68,800

- C-0B827671 — $10,700 (4 tickets)
- C-0FCCD2DF — $9,600 (3 tickets)
- C-0CEF69FD — $8,900 (3 tickets)
- C-0F876796 — $8,700 (3 tickets)
- C-14264ABD — $11,000 (3 tickets)
- C-0D9CA315 — $9,600 (1 ticket)
- C-0B0F1BAB — $10,300 (1 ticket)

**Patterns in body text:** "Checkout spins forever and then the redemption fails," "Gift card order errored out but the points were still deducted," "Redemption failed twice today; gift card email never showed up."

**Sample tickets:** IC-460025 ($8,900 — "Checkout spins forever and then the redemption fails"), IC-460024 ($9,600 — "Gift card order errored out but the points were still deducted")

**Recommendation:** Points are being deducted before the payment/gift-card fulfillment transaction commits—a classic at-least-once vs exactly-once bug. Add idempotency keys and a fulfillment retry queue that compensates on failure.

---

## 3. Billing / invoice discrepancies ⚠️ single-account
**Count:** 16 tickets | **Share of ARR exposure:** 18.3% | **Distinct accounts:** 1 | **ARR affected:** $52,000

- C-0E9C27D1 — $52,000 (16 tickets)

**Patterns in body text:** "Third invoice in a row with the same seat-count error" (3×), "Billing charged the annual renewal at the wrong tier price" (4×), "Invoice discrepancy — charged for 200 seats but we license 150" (4×).

**Sample tickets:** IC-460071 ($52k — "Third invoice in a row with the same seat-count error"), IC-460078 ($52k — "Billing charged the annual renewal at the wrong tier price")

**Recommendation:** This is a single-account escalation pattern, but at $52k ARR and 16 repeat tickets it is a churn-critical account. The billing system has a seat-count cache that diverges from the contract system and a tier-pricing lookup that doesn't honor renewal discounts. Fix both before this account's next renewal cycle.

---

## 4. Points not posting / recognition credit failure
**Count:** 20 tickets | **Share of ARR exposure:** 10.9% | **Distinct accounts:** 9 | **ARR affected:** $31,100

- C-0D3278C7 — $3,500 (3 tickets)
- C-0D6CC8E3 — $4,200 (3 tickets)
- C-0D284E42 — $3,400 (3 tickets)
- C-0BE96399 — $2,700 (3 tickets)
- C-0BF20542 — $4,500 (2 tickets)
- C-0D0B047C — $4,500 (2 tickets)
- C-0DD0626C — $2,500 (2 tickets)
- C-21FEBCBB — $2,900 (1 ticket)
- C-0B2895EF — $2,900 (1 ticket)

**Patterns in body text:** "Two recognitions I sent show as delivered but the points never arrived" (the most common phrasing), "Points not posting for our whole team after the weekend," "Missing points — my balance has not updated since Tuesday."

**Sample tickets:** IC-460004 ($3,500 — "Two recognitions I sent show as delivered but the points never arrived"), IC-460016 ($4,500 — "Points not posting for our whole team after the weekend")

**Recommendation:** The recognition-delivery event and the points-credit transaction are not atomic. The most frequent variant ("show as delivered but points never arrived") suggests the async ledger write is silently failing. Add a compensating reconciliation job that detects delivered-vs-uncredited recognitions.

---

## 5. Slack integration failures
**Count:** 14 tickets | **Share of ARR exposure:** 6.6% | **Distinct accounts:** 4 | **ARR affected:** $18,900

- C-0BA71F12 — $3,900 (6 tickets)
- C-10A56B0F — $5,400 (4 tickets)
- C-0B843542 — $4,400 (3 tickets)
- C-8C2E8F00 — $5,200 (1 ticket)

**Patterns in body text:** "Recognitions no longer post to Slack; the sync toggle resets itself" (sync toggle self-resets), "Slack slash command returns an error for everyone on our team" (slash command broken), "The Slack app disconnected and re-auth does not stick" (auth token doesn't persist).

**Sample tickets:** IC-460047 ($5,400 — "Recognitions no longer post to Slack; the sync toggle resets itself"), IC-460049 ($5,400 — "The Slack app disconnected and re-auth does not stick")

**Recommendation:** Three distinct sub-problems all point to a shared Slack OAuth token-refresh mechanism: the token expires, re-auth is attempted but the new token isn't persisted, and the sync toggle resets to off as a fallback. Consolidate the token-lifetime and refresh logic into one reliable path.

---

**Methodology note:** I ignored the existing `tag` column entirely and classified tickets by body-text content only. About 10 tickets had tags that contradicted their actual body text (e.g., tagged `billing` but describing recognition points not posting). ARR exposure is calculated as the sum of each distinct account's ARR (not the sum across repeat tickets for the same account).

# Weekly Marketing Goals Update — Q3-2026 (66 of 92 days elapsed; 71.7%)

## SQMs (Sales Qualified Meetings)
| | Value |
|---|---|
| QTD actual | 230 |
| Target | 300 |
| Delta | −70 (−23.3%) |
| % target achieved | 76.7% |
| Pace vs time elapsed | **Ahead** (76.7% > 71.7%) |

230 ÷ 300 = 0.7667; 66 ÷ 92 = 0.7174.

## SQOs (Sales Qualified Opportunities)
| | Value |
|---|---|
| QTD actual | 84 |
| Target | 120 |
| Delta | −36 (−30.0%) |
| % target achieved | 70.0% |
| Pace vs time elapsed | **Behind** (70.0% < 71.7%) |

84 ÷ 120 = 0.7000.

## DS2s (Deal Stage 2)
| | Value |
|---|---|
| QTD actual | 40 |
| Target | 75 |
| Delta | −35 (−46.7%) |
| % target achieved | 53.3% |
| Pace vs time elapsed | **Behind** (53.3% < 71.7%) |

40 ÷ 75 = 0.5333.

## Closed-Lost MIA Rate
| | Value |
|---|---|
| QTD closed-lost total | 25 |
| QTD MIA (no contact) | 5 |
| Actual MIA rate | 20.0% (5 ÷ 25) |
| Target MIA rate | ≤ 10% (lower is better) |
| Delta | +10.0pp over target |
| Assessment | **Behind** — rate is 2× the allowable ceiling |

5 ÷ 25 = 0.20. At 71.7% of the quarter elapsed, being at double the acceptable rate signals a systemic qualification or handoff issue.

## Same-Quarter Closes
| | Value |
|---|---|
| QTD actual | 10 |
| Target | 20 |
| Delta | −10 (−50.0%) |
| % target achieved | 50.0% |
| Pace vs time elapsed | **Behind** (50.0% < 71.7%) |

10 ÷ 20 = 0.5000.

## Active Pipeline Coverage ($)
| | Value |
|---|---|
| QTD actual | $3,000,000 |
| Target | $4,000,000 |
| Delta | −$1,000,000 (−25.0%) |
| % target achieved | 75.0% |
| Pace vs time elapsed | **Ahead** (75.0% > 71.7%) |

$3,000,000 ÷ $4,000,000 = 0.75.

---

## This Week's Movement

**Pipeline volume (SQM/pipeline coverage) is tracking ahead of time, but conversion is the pinch point.** SQMs hit 76.7% — above the 71.7% time mark — which feeds into a $3M active pipeline that's also slightly ahead of schedule (75.0%). That sounds good on the surface, but you're losing steam further downstream: SQOs are at just 70.0% of target (slightly behind), and DS2s are the biggest concern at 53.3% — nearly 18 points behind time. Same-quarter closes are exactly half of target with only 26 days left, which is acute.

The MIA rate of 20.0% (5 of 25 closed-lost deals) is the canary. At double the 10% ceiling, roughly 1 in 5 lost deals simply vanished without engagement — pointing to either (a) leads entering the funnel already disqualified but not being filtered at the SQM stage, (b) handoff friction between SDR and AE causing prospects to ghost, or (c) source-quality degradation that isn't being flagged until after close-lost. Worth a segment analysis on which source/rep pairs drive those 5 MIAs.

**Limited data:** No week-over-week snapshots or deal-level aliases are available in the provided files, so I cannot attribute this week's movement to specific campaigns, SDRs, or named accounts. If you have a deals_detail.csv or weekly_trend.csv I can dig deeper on what concretely moved.

Here are the responses mapped to your questionnaire. Each answer cites the source excerpt or flags the gap.

---

**Q1 — Is customer data encrypted at rest? If so, how?**
Yes. All customer data is encrypted at rest using AES-256.
*Source: P1*

**Q2 — Is data encrypted in transit?**
Yes. Data in transit is encrypted with TLS 1.2 or higher.
*Source: P1*

**Q3 — Do you hold a SOC 2 report, and can we obtain a copy?**
Yes. Bonusly maintains a SOC 2 Type II report, renewed annually. The report is available to prospects under NDA.
*Source: P2*

**Q4 — How long is customer data retained after contract termination?**
Customer data is retained for the duration of the contract plus 90 days, after which it is deleted from production systems.
*Source: P3*

**Q5 — Where is your subprocessor list published and how are changes notified?**
The current subprocessor list is maintained at **trust.bonusly.com**. Customers receive 30 days notice before a new subprocessor is added.
*Source: P4*

**Q6 — Do you support SAML single sign-on?**
Yes. SAML 2.0 single sign-on is available on the Enterprise plan. SCIM user provisioning is also supported on that plan.
*Source: P5*

**Q7 — What is your production backup schedule and retention?**
Production databases are backed up daily. Backups are encrypted and retained for 35 days.
*Source: P6*

**Q8 — Do you hold an ISO 27001 certification?**
**Unanswerable from the provided excerpts.** The policy excerpts cover SOC 2 (P2) but do not address ISO 27001. A separate ISO 27001 certification document or a discussion with our security team would be required to answer this.

**Q9 — What is your contractual uptime SLA percentage?**
**Unanswerable from the provided excerpts.** The excerpts cover security and data handling but do not include a service-level agreement or uptime commitment. A copy of the Master Services Agreement or a published SLA page would contain this figure.

show the model's full answer

**NDA-1 — GREEN**

Standard mutual NDA. Term (2-year evaluation + 3-year survival), standard five-part carve-outs with exceptions (a)–(e), Delaware governing law, and no non-solicit or non-compete. Clean.

**NDA-2 — YELLOW (counsel review)**

> *Clause 4:* "During the term of this Agreement and for eighteen (18) months thereafter, neither party shall solicit for employment or hire any employee of the other party with whom it came into contact under this Agreement."

Embedded non-solicitation with an **18-month tail** is aggressive — typical post-term non-solicits run 6–12 months. The "with whom it came into contact under this Agreement" language is standard in scope but the duration raises commercial risk for Bonusly's headcount access through evaluations. Needs an employability carve-out and a duration check by counsel. Everything else (mutual, standard carve-outs, Delaware law) is fine.

**NDA-3 — RED (full legal review)**

Three clauses drive this:

> *Clause 1:* One-way confidentiality in favor of [PARTY C].

Unilateral — only Bonusly is restricted, Party C has no obligation. Unsuitable for a mutual evaluation unless Party C is disclosing nothing, which is stated nowhere.

> *Clause 2:* "For a period of three (3) years following the Effective Date, Recipient shall not, directly or indirectly, engage in or provide services to any business that competes with Discloser's business."

Embedded **non-compete** — 3-year scope precludes providing services to *any* competitor of Party C. Reads without geographic or line-of-business limitation. Effectively bars Bonusly from its own market for 3 years. Entirely outside the purpose of an NDA.

> *Clause 4:* No confidentiality carve-outs are stated in this Agreement.

Missing standard exceptions means publicly available information, independent development, and third-party receipt are all treated as breaches. Combined with Irish governing law and exclusive Irish jurisdiction (Clause 3), Bonusly would litigate non-compete and confidentiality disputes in Dublin under foreign law. Term of 5 years is also long for an evaluation NDA. This needs full legal mark-up or a reject.