# Steerline security questionnaire

Answers to the questions a SIG Lite or CAIQ (Cloud Controls Matrix) questionnaire asks, for the Steerline multi-client service. Each answer says only what the product documentation states, with the source. Anything the documentation does not settle is marked **[to confirm]**: the operator fills it in before sending this to a customer.

- Product: Steerline, Enterprise edition (v11). The Government edition (v21) has its own stricter settings and is not covered here.
- Operator: [to confirm: legal name, address, security contact].
- Sources: `docs/SECURITY.md`, `docs/MULTI-CLIENT.md`, `docs/DATA-RESIDENCY.md`, `docs/AI.md`, `docs/SAAS.md`, `docs/OPERATIONS.md`, `docs/assurance/` (control matrix, draft policies, sub-processors, pen-test plan, DPA template) and `docs/security/vulnerability-disclosure.md`.
- The policies in `docs/assurance/policies/` are marked "draft for adoption". Where an answer depends on a policy being approved and operated, it says so.

## 1. Certifications, audits and governance (CAIQ A&A, GRC · SIG A, B, L)

| Question | Answer | Source |
|---|---|---|
| Do you hold a SOC 2 report? | Not stated as held. The assurance pack is designed to support a SOC 2 Type II examination; the docs say not to claim SOC 2 until the report is issued. The current status is on the Trust page's certification tiles. **[to confirm]** | assurance/README.md |
| Are you ISO/IEC 27001 certified? | Not stated as held. The pack is designed to support ISO/IEC 27001:2022 certification, which only an accredited body can issue. Current status on the Trust page. **[to confirm]** | assurance/README.md |
| Is there a control framework mapped to SOC 2 and ISO 27001? | Yes. A control matrix maps each control to SOC 2 Trust Services Criteria and ISO/IEC 27001:2022 Annex A, with how it is met, the evidence, the owner and the frequency. | assurance/control-matrix.md |
| Do you have an approved information security policy set? | A policy set exists in draft: information security, access control, change management, incident response, business continuity and disaster recovery, encryption and key management, data retention and deletion, logging and monitoring, risk management, secure development, vendor management, acceptable use. Approval, owners and dates: **[to confirm]** | assurance/policies/ |
| Is there a named security owner? | The policies assign a Security lead and an Engineering lead. Names: **[to confirm]** | assurance/policies/information-security.md |
| Is there a risk assessment and risk register? | The risk management policy requires one, yearly and on major change. Whether it is in place: **[to confirm]** | assurance/policies/risk-management.md, control matrix 13–15 |
| Do you have a Statement of Applicability? | To be derived from the control matrix. **[to confirm]** | control matrix 16 |
| Is there an internal audit of controls? | Required yearly by the control matrix. **[to confirm]** | control matrix 17–18 |

## 2. Data isolation and multi-tenancy (CAIQ DSP, IVS · SIG D, V)

| Question | Answer | Source |
|---|---|---|
| How is customer data separated from other customers? | Every client-owned row carries a `tenant_id`. PostgreSQL row-level security is enabled and forced on every client-owned table; the database returns or accepts only the rows of the client set for the transaction, and nothing when none is set. | MULTI-CLIENT.md, SECURITY.md |
| Can the application bypass that separation? | No. The server refuses to start if its database role is a superuser or has BYPASSRLS. | MULTI-CLIENT.md |
| How is the client of a request decided? | From the request's `Host` header (each client has its own address), never from a browser-supplied header, cookie or body. Session cookies are host-only and record the client they were issued for. | MULTI-CLIENT.md |
| Is separation tested? | Yes, on every build: cross-client tests run against real PostgreSQL as a non-superuser role (raw SQL across clients, foreign sessions, same ids in two clients, admin pages, files, live stream). | MULTI-CLIENT.md, control matrix 22 |
| Where are files stored? | In object storage (Google Cloud Storage or Alibaba Cloud OSS) under a per-client prefix `t/<client>/`. | MULTI-CLIENT.md |
| Can a customer have dedicated infrastructure? | A client that needs its own key on the database and backups gets a dedicated cell whose AlloyDB cluster uses that key. Commercial terms: **[to confirm]** | SECURITY.md (customer-managed keys) |

## 3. Encryption and key management (CAIQ CEK · SIG D, G)

| Question | Answer | Source |
|---|---|---|
| Is data encrypted in transit? | Yes. TLS at the Google Cloud load balancer or Alibaba ALB, TLS 1.2 minimum (GCP SSL policy MODERN), HTTP redirected to HTTPS, HSTS on every response, TLS to the database. | SECURITY.md, policies/encryption-key-management.md |
| Is data encrypted at rest? | Yes. Database and object storage are encrypted at rest by the cloud provider (Google-managed or customer-managed keys on Google Cloud; OSS server-side encryption). | SECURITY.md |
| Are secrets encrypted inside the application? | Yes. Identity-provider secrets, authenticator secrets, webhook secrets and integration credentials are sealed with AES-256-GCM under `TENANT_SECRETS_KEY`, or under the client's own data key when the client brings its own key. | SECURITY.md |
| How are passwords and tokens stored? | Passwords with scrypt (N=32768, r=8, p=1, 16-byte salt). One-time tokens, API keys, SCIM tokens and recovery codes only as SHA-256 hashes. | SECURITY.md |
| Can customers bring their own key? | Yes (Enterprise): a Google Cloud KMS key. Steerline keeps the client's data key only wrapped by it, re-seals the client's stored secrets under it and writes uploaded files with it. If the client disables or destroys the key, or removes access, the organization is locked within the cache time (default 5 minutes). | SECURITY.md |
| Where are keys and secrets kept? | Google Cloud Secret Manager, injected at runtime and readable only by the runtime service account; on Alibaba Cloud, SAE environment variables from Terraform (with the limits described in SECURITY.md) or KMS Secrets Manager. | SECURITY.md |
| How often are keys rotated? | The draft policy sets yearly rotation for application keys, database passwords and third-party keys. `TENANT_SECRETS_KEY` must never be rotated in the current release (SECURITY.md); the draft policy flags rotation support as an open item. **[to confirm]** | SECURITY.md, policies/encryption-key-management.md |

## 4. Identity and access management (CAIQ IAM · SIG H)

| Question | Answer | Source |
|---|---|---|
| Which sign-in methods are supported? | Per-client single sign-on with OpenID Connect (authorization code with PKCE) or SAML 2.0, email and password, emailed one-time sign-in links, and smart cards (PIV/CAC) for government deployments. | SECURITY.md |
| Is multi-factor authentication available? | Yes, for every user: passkeys and security keys (WebAuthn, user verification required), authenticator apps (TOTP), and one-time recovery codes. An administrator can require it for everyone, and require or add it on top of single sign-on. | SECURITY.md |
| Is user provisioning automated? | SCIM 2.0 provisioning and deprovisioning on Enterprise; invitations and disabling elsewhere. | SECURITY.md, control matrix 29 |
| What roles exist? | Viewer, contributor, finance and admin, each optionally limited to programs and workstreams, plus guests who read only the registers shared with them. Every rule is enforced on the server. | SECURITY.md |
| Are administrator rights least privilege? | Administrator rights are split into duties (people, security, integrations, billing, data, settings). A client can make administrator rights time-limited, switched on with a reason and optionally approved by a second administrator. | SECURITY.md |
| Is re-authentication required for sensitive actions? | Yes: changes to roles, keys, sign-in settings, exports, billing and similar need a sign-in or re-verification within 10 minutes (`STEP_UP_MINUTES`). | SECURITY.md |
| Session limits? | Encrypted, HttpOnly, Secure, SameSite cookies; 8-hour maximum and 60-minute idle timeout by default. | SECURITY.md, CONFIGURATION.md |
| Brute-force protection? | 5 failed attempts lock an account for 15 minutes; sign-in forms are limited to 20 posts a minute; per-user and per-client rate limits; Cloud Armor or WAF at the edge. | SECURITY.md |
| Are access reviews supported? | Yes. The product asks client administrators to review access every 90 days, records each decision, disables people marked for removal and exports CSV evidence. | policies/access-control.md, control matrix 30 |
| How is your own staff's access controlled? | Operators use a separate console with password plus a mandatory authenticator code, three roles (owner, support, readonly), an optional IP allowlist, a 30-minute idle timeout, and an append-only operator log. Operator access is reviewed quarterly in the console. | SECURITY.md |
| Can your staff see customer data? | Only after a client administrator grants time-limited support access (24 hours or 3 days in the app, up to 7 days through the API). The support session is read-only and is written to the client's audit log with the operator and the reason. | SECURITY.md |
| Cloud console and infrastructure access? | Named accounts with MFA and least privilege are required by the draft access control policy. Evidence: **[to confirm]** | policies/access-control.md, control matrix 35 |

## 5. Logging, monitoring and audit (CAIQ LOG · SIG G, J)

| Question | Answer | Source |
|---|---|---|
| What is logged? | Every create, update, delete, file upload and download, sign-in and refused sign-in, sign-out, access change, export and AI request, with who, when, source address, user agent, request id and the before and after values. | SECURITY.md |
| Can logs be altered? | The client audit log and the operator log are append-only: a database trigger refuses UPDATE and DELETE. The only exception is the deletion job for an offboarded client. | SECURITY.md, policies/logging-monitoring.md |
| Is tampering detectable? | Yes. Each client's entries form a SHA-256 hash chain with a gap-free sequence; the head is signed every hour (Ed25519, public key at `/.well-known/audit-signing-key.pem`). Administrators can re-check the chain at any time. | SECURITY.md |
| Can logs go to our SIEM? | Yes: Splunk (HTTP Event Collector), any HTTPS collector (JSON or CEF, signed with HMAC-SHA256), or syslog over TLS, every minute, resuming where it stopped. | SECURITY.md |
| Can customers export their audit log? | Yes, as CSV, and in the full data export. | policies/logging-monitoring.md |
| How long are logs kept? | The client audit log for the life of the contract. Application log and operator log retention: **[to confirm]** | policies/logging-monitoring.md |
| Is the service monitored? | Uptime checks, error rate and latency alerts, database and budget alerts; a public status page checks each component every minute and shows 90-day availability. | policies/logging-monitoring.md, SECURITY.md |

## 6. Application and development security (CAIQ AIS, CCC, TVM · SIG I, T)

| Question | Answer | Source |
|---|---|---|
| Is there a secure development process? | The draft secure development policy requires design notes for sensitive features, parameterized queries only, server-side validation, a strict Content Security Policy, CSRF protection, the SSRF guard for outbound calls, and code review before merge. | policies/secure-development.md |
| What runs in CI? | Typecheck, integration tests against real PostgreSQL including cross-client tests, `npm audit` (high and above fail), OSV-Scanner, CodeQL on pull requests, gitleaks over the full history, Trivy image and configuration scans, and a CycloneDX SBOM for every build. | SECURITY.md |
| Are releases signed? | Yes. Images are signed keyless with Sigstore, with SLSA build provenance and a Binary Authorization attestation signed with a Cloud KMS HSM key; Cloud Run can be set to run only attested images. | SECURITY.md |
| Web protections? | Strict CSP (same-origin scripts, no inline script, no framing), HSTS, nosniff, same-origin referrer policy, CSRF defence on every write, uploads served with safe content types. | SECURITY.md |
| Outbound requests to customer-supplied addresses? | Through an SSRF guard: https only, public addresses only (IPv4 and IPv6), no redirects, a timeout and a response size cap. | SECURITY.md |
| Penetration testing? | A plan exists: before general availability of each major version, every year and after major changes, by CREST- or OSCP/OSWE-certified testers. Dates of the last test and its results: **[to confirm]**. Customers may receive the executive summary and retest letter under NDA. | assurance/pen-test-plan.md |
| Vulnerability disclosure? | A published policy with safe harbour. Target fix times: critical 7 days, high 30, medium 90, low within 180 days. `/.well-known/security.txt` points to it. Final wording and address: **[to confirm]** | security/vulnerability-disclosure.md |
| Dependency management? | Lockfile installs, Dependabot weekly, `npm audit` in CI and nightly. | SECURITY.md |

## 7. Infrastructure and network (CAIQ IVS, DCS · SIG F, N, U)

| Question | Answer | Source |
|---|---|---|
| Where is the service hosted? | Google Cloud (Cloud Run, Cloud SQL or AlloyDB for PostgreSQL, Cloud Storage) and, for mainland China, Alibaba Cloud (SAE, ApsaraDB RDS PostgreSQL, OSS). | assurance/subprocessors.md, DATA-RESIDENCY.md |
| Physical security? | The service runs on Google Cloud and Alibaba Cloud data centres; physical controls are the providers'. Provider reports on file: **[to confirm]** | control matrix 16 (A.7 inherited) |
| Network protection? | Database on private addresses only; Cloud Run accepts traffic only from the load balancer; Cloud Armor OWASP rules, per-IP limits and optional allowlists (Alibaba: WAF-enabled ALB); optional VPC Service Controls perimeter. | SECURITY.md |
| Is the runtime hardened? | Distroless, non-root runtime image. | SECURITY.md |

## 8. Business continuity and resilience (CAIQ BCR · SIG K)

| Question | Answer | Source |
|---|---|---|
| Is the database highly available? | Yes: high-availability database across zones with automatic failover, and multi-zone application instances. | SECURITY.md, policies/business-continuity-dr.md |
| Backups? | The Terraform keeps 30 days of daily backups plus 7 days of point-in-time recovery, and versioned buckets (Cloud Storage soft delete 7 days; OSS noncurrent versions 90 days). Backups stay in the cell's jurisdiction. | SECURITY.md, policies/business-continuity-dr.md |
| Are restores tested? | The draft policy requires a monthly restore test per cell; each run is recorded and shown in the operator console. Results to date: **[to confirm]** | policies/business-continuity-dr.md, OPERATIONS.md |
| RPO and RTO? | Targets of RPO ≤ 5 minutes and RTO ≤ 4 hours, marked in the policy as targets to confirm in restore tests. **[to confirm]** | policies/business-continuity-dr.md |
| Is the service status published? | Yes, on the public status page, with incidents posted by operators. | SECURITY.md |

## 9. Incident management (CAIQ SEF · SIG J)

| Question | Answer | Source |
|---|---|---|
| Is there an incident response plan? | A draft policy with four severity levels, response and status-page times, evidence preservation and post-incident reviews. Adoption: **[to confirm]** | policies/incident-response.md |
| Will you notify us of a breach? | The draft policy commits to notifying the affected client's named contacts without undue delay and within 72 hours of becoming aware of a personal-data breach. Contractual terms: see the DPA. **[to confirm]** | policies/incident-response.md, assurance/DPA-template.md |
| Is the plan tested? | Yearly tabletop exercise required by the draft policy. **[to confirm]** | policies/incident-response.md |

## 10. Data residency, privacy and retention (CAIQ DSP · SIG P)

| Question | Answer | Source |
|---|---|---|
| Can we choose where data is stored? | Yes, where the operator runs regional cells: each region has its own application, database and storage, and a client's program data, people, files and audit log stay in its cell. The regions offered are on the Trust page. | DATA-RESIDENCY.md |
| Who are your sub-processors? | Google Cloud (hosting), Alibaba Cloud (hosting, mainland China), Stripe (card billing), Alipay (billing in mainland China), Google Workspace (outbound email), and Anthropic only if the operator offers its Claude key and the client uses it. Regions and transfer mechanisms: **[to confirm]** | assurance/subprocessors.md |
| Do you give notice of sub-processor changes? | 30 days' notice to client administrators, with a right to object under the DPA. | assurance/subprocessors.md |
| Is there a DPA? | A DPA template exists; it must be reviewed by counsel before it is offered. **[to confirm]** | assurance/DPA-template.md |
| Can we export all our data? | Yes: administrators can export everything at any time as a zip of records, people, audit log and files. Exports are audited. | policies/data-retention-deletion.md, SECURITY.md |
| What happens when we leave? | The organization becomes read-only for a closing period (default 30 days, `CLOSE_RETENTION_DAYS`), then a job permanently deletes its rows and files and emails a deletion certificate with an id and SHA-256 digest. Data remains in backups until they expire. | SAAS.md, policies/data-retention-deletion.md |
| Is personal data used to train AI models? | The documentation does not address model training. What it states: AI features are off until a client administrator turns them on, and Ask PMO uses the client's own provider key, so what a provider does with requests follows that provider's terms. **[to confirm]** | AI.md, SECURITY.md |

## 11. AI features (no CAIQ domain · SIG I)

| Question | Answer | Source |
|---|---|---|
| Are AI features on by default? | No. Business and Enterprise only, and off until a client administrator sets them up. There is an off switch for the whole organization. | SECURITY.md |
| What data reaches the model? | Only what a request needs, read with the asking person's access. Emails, phone numbers, US social security numbers, payment card numbers and IBANs are replaced with placeholders before anything is sent; API keys, tokens and private keys are removed. | SECURITY.md |
| Prompt injection? | Record text is treated as untrusted; text that looks like instructions to the AI is removed (or flagged, if the client chooses). | SECURITY.md |
| Can the AI change data? | The assistant's tools only read. Agents propose changes and messages; a person approves each one. Enterprise clients may let reminders (messages only) go without approval. | SECURITY.md, AGENTS.md |
| Is AI use logged? | Every call is logged (who, feature, model, tokens, tools, redactions, flags; never the prompt or the answer); flagged or stopped calls also go to the audit trail. | SECURITY.md |

## 12. People and suppliers (CAIQ HRS, STA · SIG C, E)

| Question | Answer | Source |
|---|---|---|
| Background checks for staff with production access? | Required by the control matrix where local law allows. **[to confirm]** | control matrix 5 |
| Confidentiality agreements and security training? | Required on hire and yearly. **[to confirm]** | control matrix 6–7 |
| Supplier reviews? | The draft vendor policy tiers suppliers, requires a security review and DPA before Tier 1 and 2 suppliers receive client data, and a yearly review. **[to confirm]** | policies/vendor-management.md |
| Payment card data? | Handled by Stripe Checkout and the Stripe portal; no card or Alipay account data reaches the platform. | SECURITY.md |
| Cyber insurance? | Not covered by the documentation. **[to confirm]** | — |

## Change log

| Date | Change |
|---|---|
| [to confirm] | First version, written from the v11 documentation. |