AI LAW TRACKER — SECURITY QUESTIONNAIRE (SELF-ASSESSED) Version 1.0 — last updated 2026-08-13 https://ai-law-tracker.com/security/questionnaire This is a self-assessment. It has not been reviewed by an external auditor, and AI Law Tracker holds no SOC 2, ISO 27001 or third-party penetration-test report. It is structured on the seventeen CAIQ v4 domains so it drops into an existing review process, but the question wording is ours, not the Cloud Security Alliance's. Where an answer is "no", the reason is given rather than left blank. SUMMARY: 54 questions — 29 yes · 6 partial · 14 no · 3 provider-inherited · 2 n/a A&A — AUDIT & ASSURANCE [No] A&A-01. Do you hold a current third-party audit report (SOC 2, ISO 27001 or equivalent)? None held and none in progress. If your process has a hard certification gate, we will not clear it today. [Yes] A&A-02. Will you complete a customer security questionnaire on request? This document is that answer, published in advance. Our DPA commits to answering a written questionnaire once in any twelve-month period, and more often where a supervisory authority requires it. [Partial] A&A-03. Do you permit customer-led on-site audits? Available where a supervisory authority requires one, or following a personal data breach affecting your data, at your cost and by arrangement. Not available on request alone. AIS — APPLICATION & INTERFACE SECURITY [Yes] AIS-01. Are application changes tested automatically before release? A test suite of over 2,200 automated checks runs on every change, alongside a syntax/parse gate across the codebase. A release-blocking gate additionally scans the diff for unfinished-work and fabrication markers. [Yes] AIS-02. Is the public API authenticated and rate-limited? API access is by key. Keys are verified against a keyed hash; the plaintext exists only at issuance and is never stored or returned afterwards. [Yes] AIS-03. Do you set browser-side security response headers? HSTS (two-year max-age, includeSubDomains, preload), X-Frame-Options: DENY and X-Content-Type-Options: nosniff. [No] AIS-04. Is a Content Security Policy enforced? Not currently enforced site-wide. The site embeds third-party analytics and advertising tags, and we have not yet done the work to lock a policy down without breaking them. Recorded as a gap rather than glossed. BCR — BUSINESS CONTINUITY & OPERATIONAL RESILIENCE [Yes] BCR-01. Are backups taken on a defined schedule? Full database backup weekly (Sundays 03:00 UTC), plus a daily 04:00 UTC row-count comparison that alerts on an unexpected drop. [Partial] BCR-02. Are restores tested? The daily count check verifies the data is intact and the backup job is genuinely producing an artifact. A full restore-to-a-clean-environment drill is not run on a schedule. [No] BCR-03. Do you offer a contractual uptime SLA? No uptime SLA and no hot standby. We rely on the hosting and database platforms' own redundancy. CCC — CHANGE CONTROL & CONFIGURATION MANAGEMENT [Yes] CCC-01. Is all production code held in version control with a full change history? Every change is committed and traceable; deployment is from the tracked branch. [No] CCC-02. Does a second person review changes before they reach production? The service is run by one operator, so there is no separation of duties. Automated gates in CI are a partial compensating control, not a substitute, and we do not present them as one. [Yes] CCC-03. Can a bad release be rolled back? The hosting platform retains previous deployments and supports promoting an earlier one. CEK — CRYPTOGRAPHY, ENCRYPTION & KEY MANAGEMENT [Yes] CEK-01. Is data encrypted in transit? TLS on all traffic, with HSTS preload so a returning browser refuses plaintext. [Provider] CEK-02. Is data encrypted at rest? Provided by the hosting and database platforms using their platform-managed encryption. We do not operate the underlying storage. [Yes] CEK-03. Are credentials and identifiers stored in a non-reversible form? API keys, IP addresses and abuse-prevention email addresses are stored as HMAC-SHA256 keyed hashes with a server-held secret, never in plaintext. [No] CEK-04. Do you support customer-managed encryption keys? Not offered. We do not operate a key management system. DCS — DATACENTER SECURITY [N/A] DCS-01. Do you operate your own datacenters or physical facilities? None. All physical security is inherited from Vercel, Supabase and (for one internal operations VM) DigitalOcean. [Yes] DCS-02. Where is customer data physically processed? The production database runs in Supabase's ap-northeast-1 (Tokyo) region. Hosting and edge delivery are on Vercel across US/global edge locations. The full sub-processor list with regions is published in our DPA. DSP — DATA SECURITY & PRIVACY LIFECYCLE [Yes] DSP-01. Do you publish a data processing agreement? Published in full at /dpa, including the parts that are not flattering, and downloadable without asking. [Yes] DSP-02. Is personal data minimised? The product is a public-law database; personal data is incidental to operating it. Identifiers we do keep are stored hashed, not in the clear. [Yes] DSP-03. Do you delete customer data on termination? Deleted or returned at your choice; absent an instruction, deleted within 30 days. Backup copies age out on their normal rotation within 90 days and are not accessed for any other purpose meanwhile. [No] DSP-04. Do you process special-category data? We ask customers not to send it. The service is not designed for it and our terms do not assume it. [Yes] DSP-05. Do you have a mechanism for data subject requests? A published request route. Where we process on a customer's behalf we refer the individual to that customer rather than answering substantively, and tell the customer promptly. GRC — GOVERNANCE, RISK & COMPLIANCE [No] GRC-01. Do you maintain a formal, board-approved information security policy? There is no board. Practices are documented publicly on our security page rather than in an internal policy set, which is the honest shape of a one-operator service. [Yes] GRC-02. Is there a named individual accountable for security? The operator, reachable at support@ai-law-tracker.com. [No] GRC-03. Do you carry out a formal periodic risk assessment? Not as a scheduled formal exercise. Risk is handled continuously through automated invariant monitoring rather than through a periodic document. HRS — HUMAN RESOURCES SECURITY [N/A] HRS-01. Do you background-screen personnel with production access? There are no employees. Production access is limited to the single operator. [Yes] HRS-02. Is everyone with access bound by confidentiality obligations? Committed in our DPA; with a single operator the obligation and the access sit with the same person. [No] HRS-03. Is there a formal security-awareness training programme? No formal programme, for the same reason there is no HR function. IAM — IDENTITY & ACCESS MANAGEMENT [Yes] IAM-01. Is multi-factor authentication enforced on production access? MFA is enabled on the underlying provider accounts through which production is reached. [Yes] IAM-02. Is database access restricted from the public internet? The application never ships a database key to the browser, so a site visitor has no path to the database. Access is server-side only, using a credential that is never exposed to a client. Row-level security is enabled on every table in the public schema behind that boundary. [Yes] IAM-03. Are administrative endpoints protected? Shared secrets held in the hosting provider's encrypted environment store, compared in constant time so a wrong token cannot be narrowed down by timing. [No] IAM-04. Do you support SSO / SAML for customer accounts? Not offered. A reasonable enterprise requirement that we do not meet today. [Yes] IAM-05. Are secrets kept out of source control? Held in the hosting provider's encrypted environment store; the repository carries only an example file naming the variables. IPY — INTEROPERABILITY & PORTABILITY [Yes] IPY-01. Can customers export their data in a standard format? The service is API-first: the full record set is retrievable as JSON over the documented /v1 API, and compliance-deadline data is additionally offered as CSV. There is no proprietary lock-in format. [Yes] IPY-02. Are API changes versioned and announced? The API is versioned under /v1 and a public changelog records changes. IVS — INFRASTRUCTURE & VIRTUALIZATION SECURITY [Provider] IVS-01. Who patches the operating systems running your workloads? Almost entirely the providers: the application and its 33 scheduled jobs run on managed serverless infrastructure with no OS for us to patch. The one exception is a single internal operations VM, patched by us, which holds no customer data and serves no public traffic. [Provider] IVS-02. Is production network-segmented from other environments? Inherited from the platform model; there is no self-managed production network to segment. LOG — LOGGING & MONITORING [Yes] LOG-01. Are application and infrastructure events logged? Request and job logs are retained by the hosting platform; job outcomes are additionally recorded in our own database with row counts written. [Yes] LOG-02. Do failures raise alerts to a human? Failures alert the operator over an always-on channel, and the alert path itself is monitored — a monitoring system that fails silently looks exactly like good news. [No] LOG-03. Can customers receive an audit-log export? Not offered today. Recorded as a gap. [Yes] LOG-04. Do you monitor for silent data failures, not just errors? Explicitly, because it is this product's characteristic failure: automated invariant checks catch a job that reports success while writing zero rows, and stale-source detection surfaces a jurisdiction that has quietly frozen. SEF — SECURITY INCIDENT MANAGEMENT [Yes] SEF-01. Will you notify customers of a personal data breach, and how quickly? Without undue delay and within 48 hours of becoming aware, per our DPA. Where the full picture is not yet available we send what we have and follow up, rather than waiting for a complete account. [Partial] SEF-02. Is there a documented incident response plan? Notification obligations and timelines are documented and contractually committed. A full internal runbook with defined severity tiers is not published. [Yes] SEF-03. Is there a route to report a vulnerability? support@ai-law-tracker.com, acknowledged within three business days. No paid bounty is offered, and no good-faith reporter will be threatened. STA — SUPPLY CHAIN & TRANSPARENCY [Yes] STA-01. Do you publish your sub-processors? Named in the DPA with purpose and processing region for each. [Yes] STA-02. Do customers get notice before a sub-processor changes? At least 30 days' notice by email, with a right to object and, if no alternative works, to terminate with a pro-rated refund. [Partial] STA-03. Do you assess the security of your sub-processors? We select established providers and rely on their published compliance posture. We do not run our own independent assessment of them, and saying otherwise would be theatre. TVM — THREAT & VULNERABILITY MANAGEMENT [Partial] TVM-01. Are dependencies monitored for known vulnerabilities? Dependencies are updated as issues surface, but we run no scheduled, evidenced dependency-scanning process and there is no automated update configuration in the repository. Treat this as a gap, not a control. [No] TVM-02. Has an independent penetration test been performed? Not commissioned, so there is no report to share. [No] TVM-03. Do you run regular automated vulnerability scanning of the application? No scheduled application-layer scanning beyond dependency alerts and the automated test/verification gates. UEM — UNIVERSAL ENDPOINT MANAGEMENT [No] UEM-01. Are endpoints with production access centrally managed (MDM)? No MDM fleet: there is one operator on one machine. Access to production depends on MFA at the provider accounts rather than on device management. [Partial] UEM-02. Is disk encryption enabled on that endpoint? Operator-attested rather than centrally enforced or evidenced: there is no management platform that could prove it, so it rests on the operator's word in a way the other answers here do not. CONTACT support@ai-law-tracker.com