Trust Center → RFP responses

30 answers, ready for procurement.

Below are pre-written answers to the questions that show up on every Enterprise security questionnaire (CAIQ, SIG-Lite, BSI-IT-Grundschutz short form). Copy them straight into your procurement tool.

Data security 4 Access control 5 Infrastructure 4 Incident response 3 Privacy & GDPR 4 Operations 4 Compliance 3 AI safety 3

Data security

Question	Answer	Evidence
ds-01How is customer data encrypted at rest?	AES-256-GCM for sensitive columns (OAuth tokens, PII, secrets) and disk-level AES-256 for the Supabase managed Postgres volumes. Encryption keys are rotated every 90 days; key custody is split between Codaiq engineering and Supabase per their HSM-backed KMS architecture.	View →
ds-02How is data encrypted in transit?	TLS 1.2+ enforced on every public endpoint with HSTS preload, OCSP stapling, and modern cipher suites (ECDHE + AEAD only). Internal service-to-service traffic uses TLS-terminated mesh routes inside Vercel and Supabase's private network.	View →
ds-03Where is customer data stored?	The architecture supports configurable provider regions and documents an EU-oriented reference deployment. Actual database, edge, backup and model-processing regions — including any third-country transfers — must be verified from the live provider accounts and executed contracts.	View →
ds-04Do you have a data classification policy?	Yes. Four levels: Public, Internal, Confidential, Restricted. Customer data is Confidential by default; secrets and PII columns are Restricted and additionally encrypted at the column level. See the Data Retention & Disposal Policy in docs/compliance/security-policies.md.	View →

Access control

Question	Answer	Evidence
ac-01Do you support SSO and SCIM?	Yes — SAML 2.0 SSO and SCIM 2.0 user provisioning are available on the Enterprise plan. Just-in-time provisioning with role mapping is supported. SAML implementation uses @node-saml/node-saml with full XML signature-wrapping protection.	View →
ac-02Is multi-factor authentication enforced?	MFA via TOTP (RFC 6238) is available for all users and required for owner/admin roles. On the Enterprise plan, customers can enforce MFA workspace-wide via the SSO IdP.	View →
ac-03Describe your role-based access control model.	Seven built-in roles (owner, admin, member, viewer, billing, auditor, integration) × a resource-action permission matrix. Workspace-scoped permissions are enforced at both the API layer and the database layer via Row-Level Security. Custom roles available on Enterprise.	View →
ac-04How is privileged access to customer data controlled?	The source includes time-bounded break-glass approval and audit-log controls. Actual personnel access, two-person enforcement, and standing-access membership must be verified in the buyer-controlled deployment.	View →
ac-05How are access reviews performed?	The product includes access-review and offboarding workflows. Cadence, remediation SLAs, and IdP group automation are operating controls that must be configured and evidenced by the operator.	View →

Infrastructure

Question	Answer	Evidence
inf-01Where is the application hosted?	The repository supports Vercel, Supabase/Postgres, Redis/BullMQ workers, and configurable regions. The active providers, regions, subprocessors, and their current attestations are deployment-specific and must be verified under buyer accounts.	View →
inf-02Do you have DDoS protection?	Application-level rate limits and security-header/WAF integration points exist in source. Edge DDoS protection and managed WAF rules depend on the selected hosting account and require deployment evidence.	View →
inf-03What is your backup strategy?	Backup, restore-verification, retention, and recovery-objective code/runbooks exist. Frequency, region, PITR window, encryption keys, RTO, and RPO are not established by source alone and must be accepted against the live deployment.	View →
inf-04How do you isolate customer data between tenants?	Logical multi-tenancy with workspace_id on every customer row, enforced via Row-Level Security on 56+ Postgres tables. Defence-in-depth code-layer guards prevent cross-tenant queries. Storage objects are prefixed with workspace_id at the path level.	View →

Incident response

Question	Answer	Evidence
ir-01Describe your incident-response process.	A six-stage incident-response playbook exists: detect → triage → contain → eradicate → recover → review. Staffing, paging coverage, response SLAs and contractual notification commitments must be verified for the operating organization; source alone does not establish them.	View →
ir-02Do you have a public status page?	Yes — www.orconic.com/status publishes uptime, current incidents, and the maintenance calendar. Subscribers receive email/RSS notifications for every incident.	View ↗
ir-03How often do you run disaster-recovery drills?	Weekly automated restore drill validates backup → fresh-Postgres → tenant-isolation invariants. Monthly chaos-engineering exercise hits a real production-like environment with controlled failures (DB outage, Redis outage, AI provider outage).	View →

Privacy & GDPR

Question	Answer	Evidence
pv-01Is there a signed DPA available?	A DPA/AVV template and an electronic acceptance implementation exist in source. Legal approval, counterparty details and evidence that a particular customer agreement was executed must be checked separately.	View →
pv-02How are sub-processors managed?	The full sub-processor list is published at orconic.com/trust/subprocessors and reviewed quarterly. Customers are notified at least 30 days in advance of any new sub-processor and may object on data-protection grounds. SCCs apply to any non-EU transfer.	View →
pv-03How do you support data-subject rights?	Self-service GDPR data-export covers 30+ tables and is signed for tamper-evidence. Erasure (Art. 17) is available via workspace settings. DPIA template is provided to assist customers in their own assessments.	View →
pv-04Do you sell or share customer data?	No. Customer data is never sold, never shared with third parties for advertising, and never used to train Codaiq's own or third-party AI models without explicit per-workspace opt-in.	View →

Operations

Question	Answer	Evidence
op-01How is source code protected?	Source code is hosted on GitHub with mandatory two-factor for every committer, branch protection on main, required code review, and CODEOWNERS gating for security-sensitive areas. CI runs the security-reviewer agent on every PR.	View →
op-02What is your vulnerability management process?	GitHub Dependabot scans daily; npm audit gates the build on Critical/High findings. Annual external penetration test; quarterly internal pentest; continuous SAST + secret-scanning in CI. Bug-bounty program available at orconic.com/responsible-disclosure.	View →
op-03How are software releases managed?	The repository contains feature flags, build-provenance/SBOM workflows, rollback runbooks, and immutable-deployment support. Hosted CI is currently disabled, so signed releases and provenance are capabilities rather than an evidenced operating history.	View →
op-04What is the SLA for production availability?	An SLA template and status endpoints exist. Availability commitments, credits, and historical uptime apply only when evidenced in an executed customer agreement and the active monitoring account.	View ↗

Compliance

Question	Answer	Evidence
cp-01Which compliance certifications do you hold?	No independent SOC 2, ISO 27001, or BSI C5 certification/attestation is conveyed by this repository. GDPR mappings are self-assessed engineering readiness and require deployment-specific legal review.	View →
cp-02Can we audit your environment?	Audit rights and notice periods are determined by the executed DPA/customer agreement. No pooled external audit report is included in this repository.	View →
cp-03Do you provide a Schrems II / TIA?	TIA/SCC templates and subprocessor records exist in source. Executed SCCs, current TIAs, provider terms, and active data flows must be verified by the operator and privacy counsel.	View →

AI safety

Question	Answer	Evidence
ai-01How is AI usage controlled and observable?	Multi-provider router with per-workspace policy (model allowlist, region pinning, data-residency tier). Every call recorded in the AI usage ledger with per-tenant cost attribution. Langfuse tracing on; prompts redacted server-side before observability export.	View →
ai-02Is customer data used to train AI models?	No. Default routing is to no-train endpoints (Anthropic EU, Mistral EU, OpenAI no-train tier). The opt-in OpenRouter/OpenAI route is gated by workspace policy and explicitly contracted to no-train under the SCCs.	View →
ai-03How do you handle prompt injection and jailbreak attempts?	Defence-in-depth: input sanitisation, function-calling allowlist, structured-output schema enforcement, output classifier, and red-team test suite in CI. Detected attempts are recorded as security events in the immutable audit log.	View →

Missing a question?

Forward your full questionnaire to security@codaiq.com — we usually return it within two business days, and the new questions land in this public bank.

Trust Pack PDF DPA / AVV