Security questionnaire

None held and none in progress. If your process has a hard certification gate, we will not clear it today.

This document is that answer, published in advance. Our DPA commits to answering a written questionnaire once in any twelve-month period, and more often where a supervisory authority requires it.

Available where a supervisory authority requires one, or following a personal data breach affecting your data, at your cost and by arrangement. Not available on request alone.

A test suite of over 2,200 automated checks runs on every change, alongside a syntax/parse gate across the codebase. A release-blocking gate additionally scans the diff for unfinished-work and fabrication markers.

API access is by key. Keys are verified against a keyed hash; the plaintext exists only at issuance and is never stored or returned afterwards.

HSTS (two-year max-age, includeSubDomains, preload), X-Frame-Options: DENY and X-Content-Type-Options: nosniff.

Not currently enforced site-wide. The site embeds third-party analytics and advertising tags, and we have not yet done the work to lock a policy down without breaking them. Recorded as a gap rather than glossed.

Full database backup weekly (Sundays 03:00 UTC), plus a daily 04:00 UTC row-count comparison that alerts on an unexpected drop.

The daily count check verifies the data is intact and the backup job is genuinely producing an artifact. A full restore-to-a-clean-environment drill is not run on a schedule.

No uptime SLA and no hot standby. We rely on the hosting and database platforms' own redundancy.

Every change is committed and traceable; deployment is from the tracked branch.

The service is run by one operator, so there is no separation of duties. Automated gates in CI are a partial compensating control, not a substitute, and we do not present them as one.

The hosting platform retains previous deployments and supports promoting an earlier one.

TLS on all traffic, with HSTS preload so a returning browser refuses plaintext.

Provided by the hosting and database platforms using their platform-managed encryption. We do not operate the underlying storage.

API keys, IP addresses and abuse-prevention email addresses are stored as HMAC-SHA256 keyed hashes with a server-held secret, never in plaintext.

Not offered. We do not operate a key management system.

None. All physical security is inherited from Vercel, Supabase and (for one internal operations VM) DigitalOcean.

The production database runs in Supabase's ap-northeast-1 (Tokyo) region. Hosting and edge delivery are on Vercel across US/global edge locations. The full sub-processor list with regions is published in our DPA.

Published in full at /dpa, including the parts that are not flattering, and downloadable without asking.

The product is a public-law database; personal data is incidental to operating it. Identifiers we do keep are stored hashed, not in the clear.

Deleted or returned at your choice; absent an instruction, deleted within 30 days. Backup copies age out on their normal rotation within 90 days and are not accessed for any other purpose meanwhile.

We ask customers not to send it. The service is not designed for it and our terms do not assume it.

A published request route. Where we process on a customer's behalf we refer the individual to that customer rather than answering substantively, and tell the customer promptly.

There is no board. Practices are documented publicly on our security page rather than in an internal policy set, which is the honest shape of a one-operator service.

The operator, reachable at support@ai-law-tracker.com.

Not as a scheduled formal exercise. Risk is handled continuously through automated invariant monitoring rather than through a periodic document.

There are no employees. Production access is limited to the single operator.

Committed in our DPA; with a single operator the obligation and the access sit with the same person.

No formal programme, for the same reason there is no HR function.

MFA is enabled on the underlying provider accounts through which production is reached.

The application never ships a database key to the browser, so a site visitor has no path to the database. Access is server-side only, using a credential that is never exposed to a client. Row-level security is enabled on every table in the public schema behind that boundary.

Shared secrets held in the hosting provider's encrypted environment store, compared in constant time so a wrong token cannot be narrowed down by timing.

Not offered. A reasonable enterprise requirement that we do not meet today.

Held in the hosting provider's encrypted environment store; the repository carries only an example file naming the variables.

The service is API-first: the full record set is retrievable as JSON over the documented /v1 API, and compliance-deadline data is additionally offered as CSV. There is no proprietary lock-in format.

The API is versioned under /v1 and a public changelog records changes.

Almost entirely the providers: the application and its 33 scheduled jobs run on managed serverless infrastructure with no OS for us to patch. The one exception is a single internal operations VM, patched by us, which holds no customer data and serves no public traffic.

Inherited from the platform model; there is no self-managed production network to segment.

Request and job logs are retained by the hosting platform; job outcomes are additionally recorded in our own database with row counts written.

Failures alert the operator over an always-on channel, and the alert path itself is monitored — a monitoring system that fails silently looks exactly like good news.

Not offered today. Recorded as a gap.

Explicitly, because it is this product's characteristic failure: automated invariant checks catch a job that reports success while writing zero rows, and stale-source detection surfaces a jurisdiction that has quietly frozen.

Without undue delay and within 48 hours of becoming aware, per our DPA. Where the full picture is not yet available we send what we have and follow up, rather than waiting for a complete account.

Notification obligations and timelines are documented and contractually committed. A full internal runbook with defined severity tiers is not published.

support@ai-law-tracker.com, acknowledged within three business days. No paid bounty is offered, and no good-faith reporter will be threatened.

Named in the DPA with purpose and processing region for each.

At least 30 days' notice by email, with a right to object and, if no alternative works, to terminate with a pro-rated refund.

We select established providers and rely on their published compliance posture. We do not run our own independent assessment of them, and saying otherwise would be theatre.

Dependencies are updated as issues surface, but we run no scheduled, evidenced dependency-scanning process and there is no automated update configuration in the repository. Treat this as a gap, not a control.

Not commissioned, so there is no report to share.

No scheduled application-layer scanning beyond dependency alerts and the automated test/verification gates.

No MDM fleet: there is one operator on one machine. Access to production depends on MFA at the provider accounts rather than on device management.

Operator-attested rather than centrally enforced or evidenced: there is no management platform that could prove it, so it rests on the operator's word in a way the other answers here do not.