# Vendor Security Questionnaire — Standard Answers

_Pre-filled answers to the questions buyer security reviews ask most
(CAIQ/SIG-style). Last reviewed: 2026-06-11. Authoritative live
sources: `/security`, `/sub-processors`, `/dpa`, `/soc2`,
`/trust-pack.md`. For anything not covered:
**security@ovriven.com** (2-business-day SLA)._

## Company & service

| Question | Answer |
| --- | --- |
| What does the service do? | Hosted AI-simulation platform: synthetic-population reaction simulations with reports, workspaces, and APIs. Outputs are framed as simulation-based estimates, never as surveys of real people. |
| Deployment model | Multi-tenant SaaS. |
| Subprocessors | Listed with data categories at `/sub-processors` (OpenAI, Stripe, AWS, Cloudflare, Google, SendGrid/Postmark/SES). Customers notified before additions. |
| Certifications | SOC 2 program in progress — see `/soc2` for current status; controls inventory available under NDA. |

## Data protection

| Question | Answer |
| --- | --- |
| Encryption in transit | TLS everywhere; HSTS on staging/production origins. |
| Encryption at rest | AES-256 at rest for the database, object storage, and backups (managed-service encryption). |
| Data classification | Customer content (simulation inputs/outputs, uploads), account identity, billing metadata, security telemetry — inventoried with retention + deletion paths in the internal PIA (summary available on request). |
| Card data | Never touches our systems — Stripe-hosted checkout and customer portal (PCI scope stays with Stripe). |
| Data sent to AI providers | Stimulus text + attachment text excerpts only, to OpenAI under a zero-data-retention API setting. Never account identity, payment data, or demographics. |
| Data residency | Primary region set at deployment; specifics confirmed during contracting. |
| Backups | Automated dumps with rotation; restore drills are run and evidence-logged (`make verify-backup` produces an auditable record). |
| Deletion | Self-service account deletion (30-day grace, configurable 0–90), per-object deletion incl. stored files, workspace retention policies, deletion aging out of rotated backups. |

## Access control & authentication

| Question | Answer |
| --- | --- |
| Customer authentication | Email+password (scrypt, per-user salt) or Google sign-in; optional TOTP MFA with single-use recovery codes; session list + revoke-others; per-workspace SSO (OIDC; SAML in beta) for Enterprise. |
| Session security | httpOnly SameSite=Lax cookies, Secure in production, 14-day TTL, server-side revocation; password change revokes all other sessions. |
| Tenant isolation | Workspace/owner authorization on every read (404 — never confirms foreign resources); workspace-scoped API keys with scopes; regression-tested cross-tenant access suites. |
| Admin access | is_admin + role tiers (support/finance/auditor/superadmin), TOTP step-up required for the admin console, all mutations hash-chain audit-logged (tamper-evident, verifiable). |
| Least privilege | Admin RBAC tiers; API keys scoped (read/run); secrets in the platform secrets manager, never in the repo (gitleaks-scanned). |

## Operations & monitoring

| Question | Answer |
| --- | --- |
| Logging & monitoring | Structured logs with PII redaction at emit time; Prometheus metrics; operator alerting (error rate, queue depth, disk, failed logins, payment-failure streaks, signup velocity, disputes, spend cap). |
| Incident response | Documented runbooks (severities SEV1–4, per-alert playbooks, deployment rollback, backup restore) + blameless postmortems. |
| Breach response | Dedicated privacy-breach runbook: severity criteria, GDPR Art. 33 72-hour assessment, affected-user enumeration tooling, user-notification template, breach register. |
| Vulnerability disclosure | security@ovriven.com (process + safe-harbor described on `/security`). |
| Change management | All changes through version control with CI (lint, type checks, ~2,400 automated tests across backend + frontend); release identity (`/version` exposes the deployed git SHA). |
| BC/DR | Tested database restore drills; deployment rollback runbook; status page at `/status`. |

## Application security

| Question | Answer |
| --- | --- |
| Input validation | Schema-validated APIs; upload allowlist + size caps + magic-byte verification; SSRF-guarded URL imports; prompt-injection pattern detection on simulation inputs. |
| Rate limiting | Per-user/IP limits on auth, runs, uploads, billing, and public intakes; per-API-key limits. |
| Security headers | nosniff, frame-deny, strict referrer policy on both origins; HSTS in production. |
| AI safety | Demographics-blind engine enforced by automated bias tests; every output carries a simulation-estimate disclaimer; acceptable-use restrictions on abusive simulation use. |

## Legal

| Question | Answer |
| --- | --- |
| DPA | GDPR Art. 28-compatible DPA (summary at `/dpa`; executable template `dpa-template.md`; SCCs/EU-US DPF for transfers). |
| MSA | Negotiation template at `msa-template.md`; Order Form at `order-form-template.md`. |
| Tax forms | W-9 / W-8 available on request via legal@ovriven.com. |
| Insurance / entity details | Provided during contracting via legal@ovriven.com. |