Finalization Tasks

This page is the working punch-list for finishing the compliance docs. Every (todo) marker in the repo is enumerated below, grouped by what kind of decision is needed, so the right person (CISO, Legal, IT, Engineering, People Ops) can sweep through their section and fill in real values.

​

How to use this page

1. Find the group that matches your area of responsibility.
2. Open the linked file, replace every (todo: ...) placeholder with a real Neuroscale value.
3. Open a PR (see the How to mark something done footer).
4. The next time someone runs rg "\(todo" docs/, your section should be empty.

​

Summary by group

Use the group counts as planning units; use the linked file:line as the source of truth.

---

​

Open gaps found in audit

Issues that need triage but are not pure value-fill placeholders.

1. handbook/compliance-frameworks.mdx:52 — CCPA owner is (todo: assign) but the same matrix gives Privacy Officer = GC. Resolve to “General Counsel (Privacy Officer)”.
2. policies/insider-trading.mdx:34 and :98 — same Access-Persons-list-owner placeholder appears twice. Two separate (todo)s for what is one decision.
3. procedures/data-retention-matrix.mdx:10 and :26 — customer-data deletion window after contract termination is (todo) in two places (matrix row + body paragraph). Must agree when filled in. Same value also referenced from handbook/compliance-calendar.mdx:154 — three places to update.
4. policies/anti-bribery.mdx:114 — (todo: confirm Audit Committee exists) overlaps with legal/whistleblower.mdx:29 (todo: confirm) Audit Committee row. Single decision; should resolve both at once.
5. policies/insider-trading.mdx:130, policies/employee-privacy.mdx:176, policies/anti-bribery.mdx:112, policies/workplace-violence.mdx:58, index.mdx:89 — five places with the same “replace Google Form with anonymous hotline” todo. One vendor decision unblocks all of them; group with the Whistleblower Policy link.
6. procedures/cross-border-transfers.mdx:33 — DPF certification (todo) says “register at dataprivacyframework.gov” but does not specify the SCC Module choice (2/3/4) when DPF is unavailable. The DPA template at templates/dpa-template.mdx references SCCs but does not pin a Module either — adversarial readers (auditors, customers’ counsel) will ask. Add module selection guidance.
7. policies/trade-compliance.mdx:54 and :121 — same screening-tool (todo) appears twice with the same options list. One decision; two placeholders.
8. public/cookie-notice.mdx:48-49 — Analytics and Marketing cookie rows have (todo: confirm) for both provider and purpose; without these the cookie banner CMP cannot be configured, which blocks GDPR/ePrivacy compliance for any EU traffic. Critical-path for the privacy program.
9. templates/dpa-template.mdx:243 — the Neuroscale signature block has Name: **(todo: name)** for the Neuroscale signatory. Should resolve to “General Counsel” or a named officer (likely the GC) and not vary across customers.
10. Helpdesk / handbook / engineering / template docs now have version-history rows. The prior tracker treated them as out of scope for v1.0 versioning. Decide whether the CISO’s v1.0 approval covers the whole docs library or whether helpdesk / handbook / engineering carry their own ownership and cadence. handbook/how-to-use.mdx still says “Version history is captured in the page footer of each policy” — update that line either way.
11. (todo: contact address) placeholders — resolved 2026-05-08; the canonical NEUROSCALE LLC address (46175 Westlake Dr Ste 300, Sterling, VA 20165) was applied across all 8 placeholders in /public/* and the DPA template’s registered-office row.
12. Live published pages are out of date with the entity decision. neuroscale.ai/privacy and neuroscale.ai/terms still sign as “Neuroscale, Inc. (Delaware corporation)” with Delaware governing law. The drafted /public/* versions in this docs site use NEUROSCALE LLC (Virginia LLC, Virginia governing law). Republish blocker — schedule the live-site swap with GC sign-off.
13. Code of Conduct non-discrimination clause needs a verbatim Title VII / state-equivalent listing. policies/code-of-conduct.mdx:24,34. Per handbook/review-actions.mdx Top-5 #4: add the standard “race, color, religion, sex (including pregnancy, sexual orientation, gender identity), national origin, age, disability, genetic information, veteran status, or any other characteristic protected by applicable federal, state, or local law” listing; add ADA reasonable-accommodation language; revisit the weapons clause against state parking-lot statutes (TX, TN, FL, MS, OK).
14. At-will / reservation-of-rights / SEC §21F-17 carveout footer missing on policies. Per handbook/review-actions.mdx Top-5 #5: every policy should carry a footer reserving Neuroscale’s right to amend, preserving at-will employment, and carving out SEC Rule 21F-17 protected whistleblower rights. The “progressive discipline” reference in policies/human-resources-security.mdx:62 can be construed to abrogate at-will employment without this carveout.
15. DTSA §1833(b) trade-secret immunity notice not present anywhere. Without this notice on confidentiality / employment / contractor agreements, exemplary damages and attorneys’ fees under the federal Defend Trade Secrets Act are forfeited. Per handbook/review-actions.mdx.
16. FCRA adverse-action process gap in HR Security policy. policies/human-resources-security.mdx references background checks but does not codify the FCRA pre-adverse / adverse-action workflow. The Adverse Action Letter template exists; the policy text should reference it and describe the required pre-adverse → 7-business-day wait → adverse-action sequence.
17. Bug bounty program details placeholder. public/trust-center.mdx:48 advertises a bug bounty with (todo: confirm program details); engineering/vulnerability-management.mdx tracker note says it’s “private (invite-only)” placeholder. Decide: launch (with scope, rewards, disclosure SLA), keep private, or remove the trust-center mention.
18. /tmp/ns-policies-review.md and /tmp/ns-legal-review.md are referenced from handbook/review-actions.mdx but /tmp is volatile. Copy both source reports into Notion or SharePoint and update the reference URLs before they get garbage-collected.

---

​

1. Effective dates & version-history rows

Resolved as of 2026-05-08. Every policy header Effective Date and every v1.0 history-row Date cell across the docs library is now filled in with May 8, 2026, with Cameron Wolfe as Author and Ishan Jadhwani as Approver. Public docs (/public/*) carry the same Effective date and a matching Last-updated value.

---

​

2. People & roles to assign

The Roles & Personnel matrix is now the canonical source. The Personnel directory and Key Contacts directory are filled in (Board, Executive Team, PR/Insurance, External-DPO retirement); these are the remaining named-role placeholders.

---

​

3. Wiki / Notion / SharePoint links to wire up

Resolved as of 2026-05-07. Every “(todo: link to X wiki / Notion / SharePoint)” placeholder in this group now points at a Neuroscale-authored doc inside this site. The new docs are listed below — each one replaced one or more (todo) markers in source files. The “Anonymous whistleblower service (EthicsPoint / NAVEX / etc.)” (todo) at legal/whistleblower.mdx:28 is not a wiki link — it is a vendor decision and is tracked in Section 13 — Anonymous-hotline migration. The (todo) at handbook/how-to-use.mdx:20 is the meta-example that explains what a (todo) marker looks like; it is intentional and excluded from the count.

---

​

4. Linear / Vanta / Better Stack / GitHub URLs to confirm

Specific external-tool URLs that need a real link, not a wiki page.

---

​

5. Tooling decisions

Wherever a docs page says “name endpoint protection / SIEM / IdP / scanner / training vendor / screening tool,” a real product needs to be filled in (and procurement / contracts should match). Action: the CISO + Engineering pick the tooling stack; Procurement confirms contracts; the docs are updated in one PR per area.

---

​

6. Numeric thresholds, frequencies, retention periods, SLAs

Every concrete number that’s still a placeholder.

Rotation & timeout cadences

Threshold	File	Suggested
Static service-account key rotation	engineering/secrets-management.mdx:24	e.g., every 90 days
Database password rotation cadence	engineering/secrets-management.mdx:25	—
Remote-access session timeout (hours)	engineering/configuration-hardening.mdx:71	—

Communication / change SLAs

Threshold	File
Customer-impacting change announcement lead time	engineering/change-management.mdx:12
Helpdesk email SLA	helpdesk/index.mdx:12
Security-issue triage acknowledgement SLA	helpdesk/report-security-issue.mdx:30
Standard SaaS access provisioning SLA	helpdesk/account-requests.mdx:27
Production / privileged access SLA	helpdesk/account-requests.mdx:28

Offboarding & customer-data deletion

Threshold	File
Remote-employee device-return window	procedures/offboarding.mdx:11
Customer-data deletion window after contract termination (matrix)	procedures/data-retention-matrix.mdx:10
Customer-data deletion window restated in body	procedures/data-retention-matrix.mdx:26
Customer-data deletion restated in compliance calendar	handbook/compliance-calendar.mdx:154

Retention periods

Item	File
Support tickets retention	procedures/data-retention-matrix.mdx:11
Support call recordings retention	procedures/data-retention-matrix.mdx:12
Security event / log retention	procedures/data-retention-matrix.mdx:13
Vulnerability scan results retention	procedures/data-retention-matrix.mdx:14
CRM / sales data retention	procedures/data-retention-matrix.mdx:15
QA scenarios / test data retention	procedures/data-retention-matrix.mdx:16
Whistleblower investigation records retention	legal/whistleblower.mdx:49, handbook/compliance-calendar.mdx:159
Insider-trading records retention	policies/insider-trading.mdx:145
FCPA-relevant records retention	policies/anti-bribery.mdx:128

Compliance-calendar first-due dates

Cadence	File
Quarterly access review	handbook/compliance-calendar.mdx:27
Annual penetration test	handbook/compliance-calendar.mdx:28
Annual policy re-acknowledgement	handbook/compliance-calendar.mdx:29
Annual BC/DR test	handbook/compliance-calendar.mdx:30
Annual IR tabletop	handbook/compliance-calendar.mdx:31

---

​

7. Privacy / GDPR / CCPA items

EU / UK Article 27 representatives are intentionally not appointed as of 2026-05-07; see the Public site reconciliation note. DSR tracker (Linear DSR Tracker project) and DPIA register (Linear DPIA Register project) are wired in the procedures and no longer carry (todo) markers.

---

​

8. Public / external content

Customer-facing pages that must be clean before any auditor or prospect sees them. Contact address resolved 2026-05-08 — NEUROSCALE LLC, 46175 Westlake Dr Ste 300, Sterling, VA 20165 — applied across /public/privacy-notice.mdx (3 places), /public/subprocessor-list.mdx, /public/cookie-notice.mdx, /public/terms-of-service.mdx, /public/california-applicant-personnel-notice.mdx (2 places), and /templates/dpa-template.mdx.

public/subprocessor-list.mdx

Item	Line
Subscription form for change notices (2 references)	public/subprocessor-list.mdx:22, :57
AWS region confirmation (EU regions?)	public/subprocessor-list.mdx:30

public/cookie-notice.mdx

Item	Line
Analytics cookie provider + purpose	public/cookie-notice.mdx:48
Marketing cookie provider + purpose	public/cookie-notice.mdx:49
Cookie-consent CMP name	public/cookie-notice.mdx:55

public/trust-center.mdx

Item	Line
SOC 2 report link (when available)	public/trust-center.mdx:19
Bug bounty program details	public/trust-center.mdx:48

public/terms-of-service.mdx

Item	Line
Republish to neuroscale.ai/terms (live page still shows “Neuroscale, Inc. (Delaware)“)	live neuroscale.ai/terms

Publishing addresses to confirm: neuroscale.ai/privacy, neuroscale.ai/cookies, neuroscale.ai/subprocessors, neuroscale.ai/trust, neuroscale.ai/terms, plus the CA Applicant & Personnel Notice URL (e.g., neuroscale.ai/ca-privacy). All pages should be reviewed by GC before publication, paired with a CMP rollout for the cookie banner. The live /privacy and /terms pages need to be republished against the LLC entity (Virginia governing law) — see open-gap #22.

---

​

9. Templates needing GC sign-off

Customer-facing fillable templates. All use {{placeholder}} syntax for customer-side fields and (todo) markers for Neuroscale-side fields that need GC’s final pen. Action: GC reviews all three and signs off on a v1.0 of each — same approval workflow as the policy v1.0s.

---

​

10. Scope decisions — SOC 2 / ISO / FedRAMP

FedRAMP roadmap: not currently in scope; revisit if any U.S. federal customer engagement is contemplated.

---

​

11. Counsel-review (multi-jurisdictional, regulatory)

These are not “fill in a value” tasks — they are pending counsel reviews. Group them so the GC (VGC LLP) can batch them.

---

​

12. Anonymous-hotline migration

Eight places currently link the same Google Form (or, in the whistleblower case, name the service generically) as the anonymous-reporting channel. One vendor decision (EthicsPoint, NAVEX, Whispli, etc.) clears all of them. Action: GC + CHRO pick a vendor; one PR replaces all 8 references above with the new URL and fills in the audit-evidence-map row at handbook/compliance-calendar.mdx:190 (currently Anonymous service vendor (todo)).

---

​

13. Other

A few items that don’t fit cleanly above.

---

​

14. Legal review findings (May 2026 audit)

A second-pass legal audit of the 15 core policies was conducted on 2026-05-08, building on the Counsel Review Package — 2026 Q2 (which closed 36 prior findings across 5 commits). The audit surfaced 50 incremental findings — drafting, clause, cross-policy-consistency, and labor-/employment-law gaps that are not (todo) placeholders and therefore not counted in the top-of-page total. They still need to be remediated before external publication. Severity distribution: 10 High, 23 Medium, 17 Low. Findings are listed below; each links the source line and gives a one-sentence recommended action.

​

High-severity findings

These create exposure or are likely customer / auditor redlines. Resolve as a coordinated PR set with GC review.

​

Medium-severity findings

Program hygiene and cross-policy consistency. Should be fixed this year.

​

Low-severity findings

Drafting / hygiene; can be batched into a cleanup PR.

​

Summary and recommended sequencing

• Same-PR clusters. F2, F15, F16, F17 (NLRA §7 + off-duty + at-will + non-discrimination listing) ride together as one labor-and-employment redline patch with GC review. F44 + F45 + F33 (deployment + vulnerability SLAs) reconcile in one PR. F22 + the existing open-gap #15 (DTSA §1833(b) notice) ride together. F46 + F34 reconcile the “customer data in non-production” rule across Data Management, Operations Security, and Secure Development in one PR.
• Single mechanical edits. F4, F8, F11, F13, F14, F32, F35, F38, F41, F47, F48 — batch into one cleanup PR.
• Critical-path before external publication. F2, F15, F39 (phantom internal audit), F42 (DPO designation sweep), F44/F45 (absolute deployment commitment + conflicting SLAs).
• Should ride into the Q3 2026 Counsel Review Package as the next-quarter open-items list.

Open a PR removing the (todo) markers from the linked file:

1. git checkout -b finalize/<area>-<short-description>
2. Open the file shown above and replace every (todo: ...) for that section with the real value.
3. Commit with a message like Finalize secrets-management rotation cadences.
4. Open a PR; tag the responsible reviewer (CISO, Legal, IT, Engineering, People Ops as appropriate).
5. Once merged, the next regeneration of this page will show the item resolved.

​

Version history