The questionnaire, answered before you send it.

Do you hold a SOC 2 Type I or Type II report?

NoNo SOC 2 report of either type exists today. We are pre-certification.

Do you hold ISO 27001, PCI DSS, or a FedRAMP authorisation?

NoNone of the three.

Has an independent penetration test been performed?

NoNo third-party penetration test has been performed, and therefore no report exists to share under NDA. See penetration testing for what is in place instead.

Do you have production customers in regulated industries we can reference?

NoThere are no financial-institution customers in production and no case studies. Any evaluation would be an early one.

Where does the service run, and who is the infrastructure provider?

Entirely on Cloudflare’s platform — edge compute for APIs and application logic, object storage for sealed artifacts, a relational store for metadata, and queues for asynchronous work. There is no second cloud in the serving path. See security overview and data residency.

Is the service multi-tenant, and how is tenant separation enforced?

Multi-tenant. Records carry a tenant identifier and queries are scoped to it. A record is only written under a tenant that already exists — that check runs before anything reaches the permanent store, so an upstream bug cannot create data under an identity that was never provisioned.

Which subprocessors do you use?

PublishedListed and maintained at subprocessors.

Is data encrypted in transit and at rest?

In transit, TLS terminates at the Cloudflare edge. At rest, storage relies on the provider’s managed encryption and access boundaries. Details and the current limits are on encryption & key management — including that customer-managed keys are not offered today.

Will you sign a DPA? A BAA?

YesA Data Processing Addendum is published, with a plain-language summary. A BAA is available.

What are your retention and deletion practices?

Documented at retention & deletion. Note the genuine tension in an evidence product: sealed records are deliberately append-only, so deletion semantics differ from an ordinary database and that page explains where.

Can we place a legal hold?

See legal hold policy.

Do you commit to a service level?

Not by defaultOur Terms state we do not commit to an SLA except where one is set out in a written enterprise agreement. What we do instead is publish the availability we actually recorded, with the raw endpoint so you can recompute it — see service availability.

Is there a status page, and is it independently verifiable?

Yesstatus.html runs live probes from your own browser against production endpoints. There is no third-party status vendor and no manual step where someone decides whether an outage counts.

How are we notified of a security incident?

See incident notification.

How do we report a vulnerability we find?

Vulnerability disclosure explains the route. We would rather hear it from you than not hear it.