Define the authority to test
Identify asset owners, approvers, allowed targets, exclusions, impact limits, testing windows, and escalation contacts. An inquiry or demonstration never grants permission to assess your systems.
Ask for observable execution
Your team should be able to understand what was attempted and why, distinguish tested from untested coverage, and identify who reviewed a conclusion. Ask a vendor to demonstrate those records, not merely promise visibility.
Evaluate access and separation
List required identity-provider integration, roles, account lifecycle, audit export, and segregation of duties. SSO and enterprise access management are evaluation requirements; Turix does not claim they are currently delivered.
Agree on the data lifecycle
Discuss credentials, evidence minimization, subprocessors, model handling, retention, deletion, access, incident communications, and contractual processing terms. Hosting this marketing website on Cloudflare does not establish a product data-residency commitment.
Bring Saudi and GCC procurement requirements
Organizations in Saudi Arabia and the GCC may have specific sector, contract, residency, language, and procurement requirements. Identify what applies with your specialists. Turix does not claim NCA approval, SAMA approval, ISO certification, or SOC 2 compliance.
Make evaluation acceptance criteria concrete
Choose a representative application and define what must be demonstrated: approved scope, usable identity context, reviewable evidence, and a defensible handoff. Availability, deployment, and security requirements are discussed before a commercial commitment.