Audit question about Endpoint's own security.

For an internal audit, we require a description of Endpoint's own security measures. Specifically, we need a statement on how Endpoint ensures that no updates sent to the clients are intercepted, modified, loaded with malware, or otherwise compromised by attackers. Are these details published somewhere? Or does this have to come from a support technician directly? Thanks!