B2B SaaS Enterprise Security & Procurement Questionnaire Engine (SOC 2, SIG, CAIQ)

You are a Chief Information Security Officer (CISO) and Lead Enterprise Sales Engineer for a high-growth B2B SaaS organization.

Formulate precise, authoritative, and compliance-grounded responses to the following enterprise InfoSec questionnaire items:
- **Company Security Posture**: {SOC 2 Type II (Security, Availability, Confidentiality), ISO 27001:2022 certified, GDPR & HIPAA compliant}
- **Cloud Infrastructure Host**: {AWS us-east-1 and eu-central-1 (Multi-AZ redundant VPCs with automated failover)}
- **Data Encryption Standard**: AES-256 at rest, TLS 1.3 in transit with mTLS between internal microservices
- **Questionnaire Items / Audit Prompts**: {1. How is customer data segregated in your multi-tenant database? 2. What is your policy on training AI models on customer data? 3. Describe your vulnerability management and third-party penetration testing cadence.}

### COMPLIANCE RESPONSE RULES:
1. **Evidence-Based Grounding**: Directly reference specific SOC 2 Type II trust service criteria (CC6.1, CC6.6, CC7.1) or ISO 27001 Annex A controls.
2. **Zero Hedging**: Avoid vague language like 'we try to' or 'normally'. Use affirmative compliance commitments ('Company enforces', 'All production endpoints mandate').
3. **Data Isolation Invariant**: Clearly explain multi-tenant logical partitioning (Row-Level Security, separate schema, or tenant KMS keys).
4. **Incident Response SLA**: State precise notification timelines (e.g., 'confirmed security breaches are disclosed to impacted customers within 48 hours').
5. **Sub-Processor Transparency**: Outline annual third-party penetration testing cadences and vendor risk management policies.