Security questionnaire

Pre-filled answers to the questions most prospect-security teams send us, aligned to the Cloud Security Alliance CAIQ category short codes for cross-reference with internal scorecards.

If your procurement workflow requires its own form, send it to security@bsns.ccand we’ll return it with answers cross-referenced to these entries plus the controls documented on /security. We aim to turn questionnaires around in 5 business days.

Honesty principle: where we don’t do something, we say so plainly and identify the compensating control. A pre-filled questionnaire is only useful if its answers survive contact with an auditor.

Application & interface security · AIS

Is the application built with secure-coding standards?

Yes. Every API route declares an explicit auth posture audited by check:api-auth in the required local suite. Cross-tenant data access is enforced at the database via FORCE-ROW-LEVEL-SECURITY rather than relying on application logic. [Tenant isolation]

How is input validation handled?

Incoming data is validated server-side at trust boundaries. Many structured payloads use Zod schemas; other routes and Server Actions use explicit type, enum, length, and allowlist checks. The Prisma schema enforces persisted types and constraints, and React escapes rendered text by default.

Do you publish a Content-Security-Policy?

Yes. Shared response headers set a self-by-default CSP with framing and object embedding denied, plus narrowly scoped third-party origins where a product requires them. Interactive HTML binds executable scripts to a per-request nonce and strict-dynamic policy; inline styles remain enabled for Next.js and styled-jsx compatibility.

Audit assurance & compliance · AAC

Do you have SOC 2 / ISO 27001 certification?

Not yet. SOC 2 Type 1 groundwork is in progress; no audit firm engaged and no target date confirmed. We will publish the firm and the audit window here when both are set. Pending certifications, this questionnaire and the controls documented at /security are the basis for assessment.

Are external penetration tests performed?

Not yet on an external basis. A May 2026 internal security pass closed 8 hardening blocks (cron auth gating, RLS carveout audit, public-token TTL audit, portal rate limits, SAML SP scoping, audit-chain backfill, idempotency anchors, key escrow). External engagement scope drafted; not contracted.

Can customers request audit-log exports for their tenant?

Yes — on request via security@bsns.cc. Tenant admins can review tenant audit events at /settings/audit and View as history at /settings/security. The cross-tenant /admin/security surface is restricted to platform operators.

Business continuity & resilience · BCR

What is your backup strategy?

Cloud SQL keeps seven days of point-in-time recovery logs, 14 automated daily backups, and deletion protection. A separate nightly job exports both logical databases, age-encrypts them client-side, and uploads ciphertext to Cloudflare R2.

What are your RPO and RTO targets?

Target RPO: at most 1 hour through Cloud SQL, or at most 24 hours if GCP-native recovery is unavailable. Target RTO: 1 hour. A pre-migration restore completed in 3 minutes 25 seconds on May 25, 2026. On August 14, current age-encrypted R2 artifacts passed a full isolated PostgreSQL 17 restore and validation sequence in under 10 technical minutes, excluding human escrow unlock and incident decision time. Cloud SQL-native recovery was posture-checked only. [Backups & continuity]

Is there a documented business continuity plan?

Yes. The technical-recovery runbooks are at docs/operations/backup-restore.md and docs/operations/dr-strategy.md. The single-operator continuity plan (legal + access transfer for the bus-factor case) is published at /help/continuity.

Change control & configuration management · CCC

How are production changes controlled?

Code ships fast-forward-only through dev → preview → master. The GCP release refuses a dirty checkout or anything other than exact origin/master, proves live production is contained by trunk, runs local verification and dependency integrity checks, and audits an image-only plan. [Change management]

Are changes peer-reviewed?

Currently a single-operator constraint — reviews use asynchronous AI review tooling that flags risk before merge. Pre-commit and required local release gates run an opinionated audit suite (auth posture, RLS coverage, env drift, security invariants, tests, and dependency integrity). GitHub Actions is defense-in-depth, not release authority. Peer review will be reintroduced when staffing allows.

Data security & lifecycle · DSI

Where is customer data stored?

Production uses two logical databases (identity and business data) on Cloud SQL PostgreSQL 17 in GCP us-west1. Preview and Development use separate logical databases and credentials on the Cloud SQL PostgreSQL 17 instance in the separate bsns-nonprod GCP project.

How is multi-tenant data isolated?

Postgres row-level security with the FORCEattribute on every tenant-keyed table. The application uses a role that doesn’t bypass RLS; the tenant identifier is set as a session GUC inside a transaction. A bug that forgets to set context returns zero rows, never another tenant’s. [Tenant isolation]

How is customer data deleted on request?

Tenant admins use Settings → Close account. Billing is cancelled and the workspace is locked immediately; a 30-day undo/export window precedes permanent deletion. Final deletion purges business and tenant-bound identity rows after automatic Stripe-customer, managed-object, Telnyx-number, Plaid, and supported Stripe Connect cleanup. User-owned Gmail grants for identities that end with the workspace use the account-deletion revocation path. Google Calendar, Zoom, and native-voice SIP credentials remain documented manual follow-ups. Data-subject-rights requests: privacy@bsns.cc, 30-day response target.

How long is data retained?

Core business records remain for the tenant lifetime unless a product-specific policy says otherwise. Examples of bounded data: soft-deleted tasks have a 30-day trash window, operational telemetry is retained for 30 days, and Wren support-question coverage logs for 180 days. Scheduling workspace deletion creates a 30-day undo/export window before final purge. Audit-chain purge is currently deferred because deleting a prefix would break chain verification.

Encryption & key management · EKM

How is data encrypted in transit?

TLS 1.2 or higher on every public endpoint; HSTS with long max-age. Production, Preview, and Development use managed Cloud SQL connectors with encrypted transport and no persistent public authorized networks.

How is data encrypted at rest?

Cloud SQL and the managed object-storage providers encrypt their storage at the platform layer. Sensitive columns (DOB, SSN, EIN, tax IDs, driver license numbers, federation private keys, telematics keys) are additionally column-encrypted with AES-256-GCM using per-app encryption keys. [Encryption]

Where are encryption keys held?

Operator-only in 1Password as the primary store, mirrored to a Bitwarden escrow with a required local fingerprint check that refuses to push divergent envvar configurations. Rotation is a documented runbook (docs/operations/env-recovery.md).

Governance & risk management · GRM

Is there a documented information-security policy?

In progress; formal policy bundle (InfoSec, AUP, IRP, BCP, Vendor Management, Access Control, Data Retention) drafted as part of SOC 2 groundwork and will publish on completion. The controls those policies will codify are already implemented and documented at /security.

Is there a risk register?

Yes — maintained as source under docs/compliance/risk-register.md(internal). The customer-visible summary of known gaps is the “What we don’t have yet” section on /security.

Human resources security · HRS

Is there segregation of duties?

Structurally limited — bsns.cc is currently a single-operator company. Compensating controls: full audit logs on every privileged action, mechanically enforced local GCP release gates, Bitwarden escrow for credential recovery, documented continuity plan for the bus-factor case.

Are background checks performed on employees?

Not applicable today (sole operator is the founder). Policy will require completed background check before a new hire receives production credentials.

Is security training conducted?

Not applicable today. Will be required for any future hire with production access.

Identity & access management · IAM

Is MFA required for all user accounts?

Enforced by default. New password-based accounts have a 7-day grace window to enroll a passkey or TOTP. A current Google or Apple federated sign-in satisfies the requirement through that provider. A tenant admin may exempt a non-admin teammate with a recorded reason; administrators cannot be exempted.

Is MFA required for administrative access?

Yes for the operator and tenant admins. Administrator accounts cannot receive the tenant-level MFA exemption.

How are passwords stored?

Argon2id; never logged.

Does the product support SSO / SAML for enterprise tenants?

Yes. SAML 2.0 federation for enterprise tenants; IdP private keys encrypted with a dedicated key separate from the column- PII key so a key compromise blast radius stays scoped.

Infrastructure & virtualization security · IVS

Are systems segmented between environments?

Yes. Production runs in the bsns-production GCP project with Cloud SQL, Cloud Run, Scheduler, and Secret Manager. Preview and Development share the bsns-nonprod GCP project and Cloud SQL instance, but use separate passive Cloud Run services, logical databases, database logins, and Secret Manager bundles. Neither non-production tier receives production credentials.

Is network access to the database restricted?

Database credentials are per-environment and never copied into Preview or Dev. Production’s managed Cloud SQL connector is required, transport is encrypted-only, and there are zero authorized networks. Google IAM, separate database credentials, FORCE-ROW-LEVEL-SECURITY, and audit logs provide layered controls.

Interoperability & portability · IPY

Can customers export their data?

Yes — from Settings → Data export in the active tenant apps that expose it. Archives use JSON for included entities, CSV for spreadsheet-friendly entities, a manifest, and a README that names exclusions/redactions. They are structured for migration, but they are not a promise of one-click whole-archive re-import; direct import exists only where the source app documents an importer. Pact bundles hash-verified final PDFs for completed documents in its archive. If executed PDFs exceed the bounded 500 MiB one-download path, the export refuses the incomplete archive and directs the tenant admin to support for a secure split.

What happens to my data if I cancel?

The current self-serve close-account flow cancels the next renewal and locks the workspace immediately, then provides 30 days to export or undo. An already-paid period is not prorated. After that date, the tenant is permanently purged per the deletion process above.

Security incident management · SEF

How are security incidents detected?

Application errors and slow queries forward to a central observability surface; Google Cloud alert policies and a proved email channel cover production, cron failures are caught by a dead-man’s switch, and Better Stack plus Healthchecks.io remain independent external signals. Public disclosures are accepted at security@bsns.cc and /.well-known/security.txt (RFC 9116).

What is your incident-response timeline?

Receipt of a vulnerability report: confirmed within 24 hours. Status update: within 5 business days. Customer notification for business-impacting incidents: as soon as scope is understood, via /status and direct email to tenant admins.

Supply chain transparency · STA

Do you publish a list of sub-processors?

Yes, at /security/sub-processors with vendor, purpose, region, and DPA status. The list is maintained in source control and changes go through pull request.

How are sub-processors managed?

Internal vendor register at docs/compliance/vendor-register.mdtracks DPA status, review cadence, and last-reviewed date. We commit to 30 days’ notice before adding a new sub-processor.

Threat & vulnerability management · TVM

How are dependencies scanned for vulnerabilities?

GitHub Dependabot for the JavaScript/TypeScript stack and local advisory plus registry-signature audits for the web and mobile dependency trees. High and critical advisories block release; GitHub’s weekly workflow mirrors the checks when Actions is available.

How are infrastructure vulnerabilities managed?

Google Cloud handles platform patching for Production, Preview, and Development. This is a deliberate managed-platform tradeoff. Application dependency patching is operator-driven through Dependabot and the local release-blocking audit above.