Security Questionnaire

Account data (name, email, workspace name), approval request payloads (customer-defined — may include PII), decision metadata (reviewer, timestamp, reason code), audit logs, and usage analytics. Full breakdown in our DPA.

Yes. Every database query is filtered by workspaceId at the ORM layer (Prisma). No query can return data belonging to a different workspace. This is enforced at the application layer, not relying on database-level row security alone.

No. Approval request payloads and decisions are used solely to operate the service. We do not use customer data to train, fine-tune, or improve any AI or ML model.

Primary database: PostgreSQL on Supabase (EU-West, Frankfurt by default) or customer-specified region on Enterprise. Application: Vercel (EU regions available). Customers can request EU-only data residency on the Enterprise plan.

Yes. AES-256 encryption at rest, managed by the database provider (Supabase/PostgreSQL). Connection Keys (API secrets) are additionally hashed with bcrypt before storage and never stored in plaintext.

Yes. All connections use TLS 1.3. Plaintext HTTP is rejected at the edge. HSTS is enforced in production.

Yes. TOTP-based 2FA (Google Authenticator, Authy, etc.) is available for all accounts via Settings → Security. When enabled, users must complete the TOTP challenge after password verification before a session is issued.

SAML 2.0 SSO is available on the Enterprise plan. Google OAuth is available as an additional login method on all plans.

SCIM provisioning is on the Enterprise roadmap. Not currently available. Enterprise customers can manage users via the team management dashboard.

Four roles: OWNER (all permissions including billing), ADMIN (approvals, settings, team management), REVIEWER (approve/reject/modify requests only), VIEWER (read-only). Roles are enforced on every API route server-side.

Yes. IP allowlist (IPv4 and CIDR ranges) is available on the Enterprise plan. Configured under Settings → Security. Access from unlisted IPs redirects to an access-denied page.

Connection Keys are prefixed (cq_live_...), cryptographically random, hashed with bcrypt before storage, and never exposed in logs. Keys can be rotated instantly from the AI Assistants dashboard. Rotation immediately invalidates the previous key.

Yes. Rate limiting (Upstash Redis) is applied at the login, signup, and API submission endpoints. Login is subject to sliding-window rate limits. Password attempts trigger lockout after repeated failures.

Sessions use HMAC-SHA256 signed cookies (cheq_session). No tokens are stored in localStorage. Sessions are httpOnly, secure, sameSite=lax, with a 30-day max-age. Session signing keys are rotated when SESSION_SECRET is rotated.

Application layer: Vercel (serverless functions, global edge). Database: Supabase (managed PostgreSQL, EU-West). Email: Resend. Payments: Stripe. Full list of sub-processors in our DPA.

99.9% monthly uptime target. Real-time status available at cheqpoint.co/status.

Yes. Supabase provides automated daily backups and point-in-time recovery. Retention of backups: 7 days on standard plans, 30 days for Enterprise database configurations.

Yes. Primary failover relies on Vercel's multi-region edge deployment and Supabase's automated standby. RTO target: 4 hours. RPO target: 1 hour (point-in-time recovery). Full DR runbook available to Enterprise customers on request.

The application layer (Vercel) runs across multiple regions globally. Database: Supabase runs in a single primary region with automated failover. EU-region replication available for Enterprise customers.

Yes. Report vulnerabilities to security@cheqpoint.co. We acknowledge within 24 hours and resolve critical issues within 72 hours. We do not pursue legal action against good-faith security researchers.

Automated dependency scanning via GitHub Dependabot and npm audit. Critical CVEs are patched within 72 hours. Non-critical patches are applied in weekly maintenance windows.

Internal security reviews are conducted on each major release. Third-party penetration testing is planned for Q1 2027 as part of the SOC 2 Type II certification process.

Yes. All code changes go through pull request review with mandatory code review. TypeScript strict mode and ESLint are enforced. Production deployments require a clean build and lint check.

Yes. The audit log records every approval request, decision (approve/decline/modify), rule match, auto-decision, configuration change, team invite, and key rotation — with actor, timestamp, and payload.

Yes. Audit log entries are immutable — they cannot be modified or deleted through any product interface. Each entry stores a SHA-256 chain hash linking it to the previous entry, providing cryptographic tamper-evidence across the full log. Hard deletes require direct database access, which is restricted to platform administrators.

Yes. CSV export is available on Growth and above. Filterable by date, agent, reviewer, decision type, and regulatory tag.

Starter: 30 days. Growth: 90 days. Business: 1 year. Enterprise: Custom (configurable, up to indefinite). Retention period is set in workspace settings and enforced nightly.

Yes. We maintain a documented incident response plan covering detection, containment, eradication, recovery, and post-incident review. The plan is reviewed quarterly.

Material security incidents that affect customer data are notified by email to the workspace OWNER within 72 hours of confirmation. Status updates are published at cheqpoint.co/status.

Cheqpoint acts as a data processor. We notify the data controller (customer) within 72 hours of becoming aware of a personal data breach so the controller can meet their GDPR Article 33 notification obligations to the supervisory authority.

SOC 2 Type II audit is in progress, expected Q1 2027. Controls are mapped to all five Trust Service Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy). Pre-certification security documentation is available to Enterprise customers on request at security@cheqpoint.co.

Controls align with ISO 27001 domains including access control, incident management, cryptography, and supplier relationships. Formal ISO 27001 certification is planned following SOC 2 Type II completion.

Yes. Cheqpoint processes personal data as a data processor under a Data Processing Agreement (DPA). The DPA covers lawful basis, data categories, retention, sub-processors, international transfers, and data subject rights. Available at cheqpoint.co/legal/dpa.

Yes. Cheqpoint is specifically designed as the human oversight layer required by EU AI Act Article 14 for high-risk AI deployers. Every AI agent action requires human review before execution. The platform generates Article 14 Compliance Reports with document reference numbers for regulators.

Yes. BAAs are available for Enterprise customers in healthcare contexts. Contact security@cheqpoint.co to initiate a BAA.

Yes. Available at cheqpoint.co/legal/dpa. Covers parties, data categories, retention, data subject rights, technical measures, sub-processors, and international transfer mechanisms (SCCs, IDTAs).

Cheqpoint does not process payment card data. Stripe handles all payment processing and is PCI DSS Level 1 certified. Cheqpoint does not store, transmit, or process cardholder data.

Yes. Sub-processors: Vercel (hosting), Supabase (database), Resend (email), Stripe (payments), Slack (optional notification delivery). Full list with DPA links is in our DPA at cheqpoint.co/legal/dpa.

Customers are notified by email 30 days before any new sub-processor is added or material changes are made to existing sub-processors. Customers who have signed a DPA may object within the notice period.

Yes. We maintain DPAs with all sub-processors and review their security certifications annually. Vercel (SOC 2 Type II), Supabase (SOC 2 Type II), Stripe (PCI DSS Level 1, SOC 2 Type II), Resend (SOC 2 in progress).

Yes. Business continuity covers application failover (Vercel multi-region), database recovery (Supabase PITR), and communication procedures. The plan is reviewed annually.

In the event of service discontinuation, customers will receive 90 days written notice and the ability to export all data (approval history, audit log, account data) in CSV format before deletion.