{"standard":"CAIQ-style","version":"2026-11-09","idScheme":"Question IDs are The Quantum Club's own; they are not CSA CCM control IDs.","domains":[{"domain":"Governance, Risk & Compliance","items":[{"id":"GRC-01","q":"Do you maintain documented information-security policies?","a":"yes","note":"Published security model + security, acceptable-use and privacy policies."},{"id":"GRC-02","q":"Do you hold a SOC 2 Type II attestation?","a":"planned","note":"Controls implemented to the criteria; independent attestation on the roadmap."},{"id":"GRC-03","q":"Are you ISO/IEC 27001 certified?","a":"planned","note":"ISMS mapped to 27001:2022 Annex A; certification planned."},{"id":"GRC-04","q":"Do you review sub-processors and require DPAs?","a":"partial","note":"Sub-processors reviewed; a GDPR-compliant DPA is in place with 6 of 9. For the other 3 (LiveKit, Deepgram, AWS S3) it is being confirmed."},{"id":"GRC-05","q":"Do you perform vendor / third-party risk review before onboarding a sub-processor?","a":"yes","note":"Each sub-processor is assessed for data handling, region and DPA terms before use; the list is published here."},{"id":"GRC-06","q":"Do you notify customers of sub-processor changes?","a":"yes","note":"The sub-processor list is published with a subscribe-to-changes option so customers are notified of additions."}]},{"domain":"Identity & Access Management","items":[{"id":"IAM-01","q":"Do you support enterprise SSO (SAML 2.0 / OIDC)?","a":"yes","note":"SAML 2.0 and OIDC federation for partner organisations."},{"id":"IAM-02","q":"Do you support SCIM user provisioning?","a":"yes","note":"SCIM 2.0 (RFC 7644) joiner/mover/leaver with audit trail."},{"id":"IAM-03","q":"Is multi-factor authentication available and enforceable?","a":"yes","note":"MFA with enforcement + step-up (AAL2) for sensitive operations."},{"id":"IAM-04","q":"Do you offer phishing-resistant authentication?","a":"yes","note":"Passkey-first (WebAuthn, user verification)."},{"id":"IAM-05","q":"Is access governed by least-privilege RBAC?","a":"yes","note":"Role-based access; tenant isolation enforced at the database layer."}]},{"domain":"Data Security & Encryption","items":[{"id":"DSE-01","q":"Is data encrypted in transit?","a":"yes","note":"TLS 1.2 or later offered; HSTS for one year, subdomains included."},{"id":"DSE-02","q":"Is data encrypted at rest?","a":"yes","note":"Database, storage and backups encrypted at rest (AES-256)."},{"id":"DSE-03","q":"Is customer data logically isolated between tenants?","a":"yes","note":"Postgres Row-Level Security across 100+ tables."},{"id":"DSE-04","q":"Is customer data resident in a specific region?","a":"yes","note":"European Union (AWS eu-west-1); no relocation outside the EU."}]},{"domain":"Application & Operational Security","items":[{"id":"AOS-01","q":"Do you rate-limit authentication endpoints?","a":"yes","note":"Atomic, auth-aware, fail-closed limiter (per-account + per-IP)."},{"id":"AOS-02","q":"Do you monitor for anomalous / abusive activity?","a":"yes","note":"Continuous anomaly detection every 5 min (alerting)."},{"id":"AOS-03","q":"Do you have a vulnerability-disclosure policy?","a":"yes","note":"Coordinated-disclosure policy + security.txt (RFC 9116)."},{"id":"AOS-04","q":"Do you run a bug-bounty programme?","a":"planned","note":"A VDP is published; a bounty programme is on the roadmap."},{"id":"AOS-05","q":"Do you commission independent penetration tests?","a":"planned","note":"Internal security reviews today; third-party pen-test on the roadmap."},{"id":"AOS-06","q":"Do you maintain an audit log of security events?","a":"yes","note":"Security-relevant events recorded to an append-only stream."},{"id":"AOS-07","q":"Do you support audit-log / SIEM export?","a":"partial","note":"Append-only audit stream today; records available on request. Self-service SIEM export is on the roadmap."},{"id":"AOS-08","q":"Do you follow a change-management process for production changes?","a":"yes","note":"Changes go through version control and review before release; database changes ship as reviewed migrations."},{"id":"AOS-09","q":"Do you follow a secure software development lifecycle (SDLC)?","a":"partial","note":"Code review, automated checks and dependency hygiene in place; a formally attested SDLC is part of the SOC 2 / ISO roadmap."},{"id":"AOS-10","q":"Do you have a documented incident-response process?","a":"partial","note":"Anomaly alerting and a defined breach-notification SLA are live; a fully documented IR runbook is being formalised alongside the SOC 2 programme."}]},{"domain":"Privacy & Data Rights","items":[{"id":"PDR-01","q":"Do you support GDPR data-subject requests (access, export, erasure)?","a":"yes","note":"Self-service from in-app privacy settings."},{"id":"PDR-02","q":"Is a Data Processing Agreement available?","a":"yes","note":"DPA with SCCs available to every customer."},{"id":"PDR-03","q":"Is customer data deleted on contract termination?","a":"yes","note":"Deletion on request; defined retention windows."},{"id":"PDR-04","q":"Do you provide a data-deletion SLA / defined retention windows?","a":"yes","note":"Deletion honoured on request; each data type has a defined retention window, not indefinite storage."},{"id":"PDR-05","q":"Is your sub-processor list published?","a":"yes","note":"Published on this Trust Center with a subscribe-to-changes option."}]},{"domain":"AI Governance","items":[{"id":"AIG-02","q":"Is there human oversight of AI-assisted decisions?","a":"yes","note":"Club AI is assistive; a human always makes the hiring decision."},{"id":"AIG-03","q":"Are AI model sub-processors disclosed?","a":"yes","note":"Named in the sub-processor table with region and data terms."},{"id":"AIG-04","q":"Do you address EU AI Act obligations for hiring AI?","a":"yes","note":"Built for transparency, human oversight and against adverse impact (high-risk class)."}]},{"domain":"Resilience & Continuity","items":[{"id":"RES-01","q":"Do you maintain encrypted backups?","a":"yes","note":"Backups encrypted at rest."},{"id":"RES-02","q":"Do you have a defined breach-notification SLA?","a":"yes","note":"Within 72 hours of awareness (GDPR Art. 33/34)."},{"id":"RES-03","q":"Do you publish a real-time status page?","a":"yes","note":"status.thequantumclub.com: live component health + historical uptime."}]}]}