Is this something that can help you answer your questions: https://evaluation-guide.mendix.com/evaluation-guide/enterprise-capabilities/security?
Through my Customer Success Manager, I got the Mendix report “ISAE 3000 / Service Organization Control Report Type II”. In my experience, such a report is usually enough to satisfy many of the questions of security officers. In any case, I would contact your Customer Success Manager, and see what kind of official report you can get the answers your questions.
This is what i was looking for. Thanks guys!