Vision Menu, Inc.

Security & Compliance Report

Last Updated: October 1, 2026

Report Summary

Drata tests Vision Dealer Solutions's security and IT infrastructure daily to ensure the company maintains a strong security posture, as defined by industry-standard security standards.

In this report, Vision Dealer Solutions:

• Tests a complete set of security and infrastructure controls that may appear in an audit

• Identifies gaps and vulnerabilities in infrastructure and processes

This document is updated continuously. As Vision Dealer Solutions improves its security posture, those efforts will be instantly visible.

Intended Use

This Vision Dealer Solutions Report can be used by:

• Vision Dealer Solutions to identify issues critical for remediation

• Vision Dealer Solutions's customers to understand the company's security posture

Drata's Approach of Continuous Monitoring

Drata continuously monitors the company's policies, procedures, and IT infrastructure to ensure the company adheres to industry standards.

To do this, Drata connects directly to the company's infrastructure accounts, version control and developer tools, task trackers, endpoints, hosts, HR tools, and internal policies. Drata then continuously monitors these resources to determine if the company meets defined framework standards.

Data and Privacy

Customer Data Policies

2 Controls

Customer Data Policies

Vision Dealer Solutions Management has approved all policies that detail how customer data may be made accessible and should be handled. These policies are accessible to all employees and contractors.

Continuously Monitored via 2 Drata Tests

Policies Cover Employee Access

Inspected Vision Dealer Solutions's policies and confirmed that they outline the requirements for granting employees access to and removing employees access from customer data.

Policies Cover Employee Confidentiality

Inspected Vision Dealer Solutions's policies and confirmed that they require employees to keep confidential any information they learn while handling customer data.

Least-Privileged Policy for Customer Data Access

Vision Dealer Solutions authorizes access to information resources, including data and the systems that store or process customer data, based on the principle of least privilege.

Continuously Monitored via 1 Drata Test

Least Privilege Policy for Customer Data Access

Inspected Vision Dealer Solutions's security policies and confirmed that they require that employees may only access the customer data they need in order to complete their jobs.

Internal Admin Tool

1 Control

Require Encryption of Web-Based Admin Access

Vision Dealer Solutions uses encryption to protect user authentication and admin sessions of the internal admin tool transmitted over the Internet.

Continuously Monitored via 1 Drata Test

SSL/TLS on Admin Page of Infrastructure Console

Inspected Vision Dealer Solutions's admin page and login of the company's Infrastructure as a Service provider and determined that all connections happen over SSL/TLS with a valid certificate from a reliable Certificate Authority.

Internal Security Procedures

Software Development Life Cycle

5 Controls

Critical Change Management

Vision Dealer Solutions authorizes designated member(s) with the autonomy to validate, change, and release critical security patches and bug fixes, outside of the standard change management process, when absolutely necessary to ensure security standards and availability of the systems.

Version Control System

Vision Dealer Solutions uses a version control system to manage source code, documentation, release labeling, and other change management tasks. Access to the system must be approved by a system admin.

Continuously Monitored via 3 Drata Tests

A Version Control System is Being Used

Inspected Vision Dealer Solutions's version control system and confirmed it is being used.

Only Authorized Employees Access Version Control

Inspected Vision Dealer Solutions's version control system and confirmed that the users of the tool were all authenticated to the company's account.

Only Authorized Employees Change Code

Inspected Vision Dealer Solutions's version control system and confirmed that approved employees can make changes to the code on a branch to which they have approval.

Code Review Process

When Vision Dealer Solutions's application code changes, code reviews and tests are performed by someone other than the person who made the code change.

Continuously Monitored via 1 Drata Test

Formal Code Review Process

Drata validated configurations for the version control system repositories and confirmed code reviews are enforced via branch restrictions.

Production Code Changes Restricted

Only authorized Vision Dealer Solutions personnel can push or make changes to production code.

Continuously Monitored via 1 Drata Test

Production Code Changes Restricted

Drata inspected Vision Dealer Solutions's version control tool and confirmed that only authorized personnel push or make changes to production code.

Separate Testing and Production Environments

Separate environments are used for testing and production for Vision Dealer Solutions's application.

Responsible Disclosure Policy

2 Controls

Employee Disclosure Process

Vision Dealer Solutions provides a process to employees for reporting security, confidentiality, integrity, and availability features, incidents, and concerns, and other complaints to company management.

Continuously Monitored via 1 Drata Test

Process for Responsible Disclosure

Drata inspected Vision Dealer Solutions's security policies and confirmed that they detail a process for employees to report security, confidentiality, integrity, and availability failures, incidents, and concerns.

Disclosure Process for Customers

Vision Dealer Solutions provides a process to external users for reporting security, confidentiality, integrity, and availability failures, incidents, concerns, and other complaints.

Continuously Monitored via 1 Drata Test

Contact Information Available to Customers

Vision Dealer Solutions has provided a URL to their customer-accessible support documentation where support contact information is readily available. Drata also confirmed that users are encouraged to contact appropriate Vision Dealer Solutions personnel if they become aware of items such as operational or security failures, incidents, system problems, concerns, or other issues/complaints.

Access Control

3 Controls

System Access Control Policy

Vision Dealer Solutions has a defined System Access Control Policy that requires annual access control reviews to be conducted and access request forms be filled out for new hires and employee transfers.

Continuously Monitored via 1 Drata Test

System Access Control Policy

Drata inspected Vision Dealer Solutions's System Access Control Policy and confirmed that it includes annual access control review requirements, and requires access request forms for new hires and employee transfers.

Annual Access Control Review

Vision Dealer Solutions performs annual access control reviews.

Baseline Configuration and Hardening Standards

Vision Dealer Solutions has identified and documented baseline security configuration standards for all system components in accordance with industry-accepted hardening standards or vendor recommendations. These standards are reviewed periodically and updated as needed (e.g., when vulnerabilities are identified) and verified to be in place before or immediately after a production system component is installed or modified (e.g., through infrastructure as code, configuration checklists, etc.).

Vulnerability Management

11 Controls

Network Segmentation in Place

Vision Dealer Solutions maintains an accurate network diagram that is accessible to the engineering team and is reviewed by management on an annual basis.

Annual Risk Assessment

Vision Dealer Solutions conducts a Risk Assessment at least annually.

Quarterly Vulnerability Scan

Vision Dealer Solutions engages with third-party to conduct vulnerability scans of the production environment at least quarterly. Results are reviewed by management and high priority findings are tracked to resolution.

Annual Penetration Tests

Vision Dealer Solutions engages with third-party to conduct penetration tests of the production environment at least annually. Results are reviewed by management and high priority findings are tracked to resolution.

Organizational Chart Maintained

Vision Dealer Solutions reviews its organizational structure, reporting lines, authorities, and responsibilities in terms of information security on an annual basis.

Information Security Policy

Vision Dealer Solutions has a defined Information Security Policy that covers policies and procedures to support the functioning of internal control.

Maintains Asset Inventory

Vision Dealer Solutions identifies, inventories, classifies, and assigns owners to IT assets.

Architectural Diagram

Vision Dealer Solutions maintains an accurate architectural diagram to document system boundaries to support the functioning of internal control.

Asset Management Policy

Vision Dealer Solutions has a defined policy that establishes requirements for the proper management and tracking of organizational assets.

Risk Assessment Policy

Vision Dealer Solutions has defined a formal risk management process that specifies risk tolerances and the process for evaluating risks based on identified threats and the specified tolerances.

Remediation Plan

Vision Dealer Solutions's Management prepares a remediation plan to formally manage the resolution of findings identified in risk assessment activities.

Security Issues

3 Controls

Continuous Control Monitoring

Vision Dealer Solutions conducts continuous monitoring of security controls using Drata, and addresses issues in a timely manner.

SLA for Security Bugs

Vision Dealer Solutions tracks security deficiencies through internal tools and closes them within an SLA that management has pre specified.

Security Issues Are Prioritized

Vision Dealer Solutions tracks and prioritizes security deficiencies through internal tools according to their severity by an independent technical resource.

Business Continuity

4 Controls

Disaster Recovery Plan

Vision Dealer Solutions has an established Disaster Recovery Plan that outlines roles and responsibilities and detailed procedures for recovery of systems.

BCP/DR Tests Conducted Annually

Vision Dealer Solutions conducts annual BCP/DR tests and documents according to the BCDR Plan.

Multiple Availability Zones

Vision Dealer Solutions utilizes multiple availability zones to replicate production data across different zones.

Business Continuity Plan

Vision Dealer Solutions has a defined Business Continuity Plan that outlines the proper procedures to respond, recover, resume, and restore operations following a disruption.

Incident Response Plan

4 Controls

Follow-Ups Tracked

Vision Dealer Solutions has implemented an Incident Response Plan that includes creating, prioritizing, assigning, and tracking follow ups to completion and lend support to Business Continuity/Disaster Recovery.

Incident Response Team

Vision Dealer Solutions has identified an incident response team that quantifies and monitors incidents involving security, availability, processing integrity, and confidentiality at the company.

Lessons Learned

Vision Dealer Solutions has implemented an Incident Response Plan that includes documenting “Lessons Learned” and "Root Cause Analysis" after incidents and sharing them with the broader engineering team to support Business Continuity/Disaster Recovery.

Incident Response Plan

Vision Dealer Solutions has an established Incident Response Plan that outlines management responsibilities and procedures to ensure a quick, effective, and orderly response to information security incidents and annual testing.

Organizational Security

Security Policies

3 Controls

Security Policies

Company policies are accessible to all employees and, as appropriate, third parties. Personnel are required to acknowledge the information security policy and other topic-specific policies based on their job duties during onboarding and annually thereafter.

Oversight of Security Controls

Management reviews security policies on an annual basis.

Software Development Life Cycle Policy

Vision Dealer Solutions has developed policies and procedures governing the system development life cycle, including documented policies for tracking, testing, approving, and validating changes.

Security Program

3 Controls

Security Team/Steering Committee

Vision Dealer Solutions has an assigned security team that is responsible for the design, implementation, management, and review of the organization's security policies, standards, baselines, procedures, and guidelines.

Security Training

Vision Dealer Solutions has established training programs for privacy and information security to help employees understand their obligations and responsibilities to comply with Vision Dealer Solutions's security policies and procedures, including the identification and reporting of incidents. All full-time employees are required to complete the training upon hire and annually thereafter.

Security Team Communicates in a Timely Manner

The security team communicates important information security events to company management in a timely manner.

Personnel Security

10 Controls

Termination/Offboarding Checklist

Vision Dealer Solutions uses a termination checklist to ensure that an employee's system access, including physical access, is removed within a specified timeframe and all organization assets are properly returned.

Acceptable Use Policy

Vision Dealer Solutions has policies and procedures in place to establish acceptable use of information assets approved by management, posted on the company wiki, and accessible to all employees. All employees must acknowledge the Acceptable Use Policy upon hire.

Background Checks

Vision Dealer Solutions's new hires are required to pass a background check as a condition of their employment.

Contractor Requirements

Vision Dealer Solutions requires its contractors to read and acknowledge the Code of Conduct, read and acknowledge the Acceptable Use Policy, and pass a background check.

Code of Conduct

Vision Dealer Solutions has a formal Code of Conduct approved by management and accessible to all employees. All employees must acknowledge the Code of Conduct upon hire.

Data Protection Policy

Vision Dealer