Security questionnaire

Do you maintain documented information-security policies?

Published security model + security, acceptable-use and privacy policies.

Do you hold a SOC 2 Type II attestation?

Controls implemented to the criteria; independent attestation on the roadmap.

Are you ISO/IEC 27001 certified?

ISMS mapped to 27001:2022 Annex A; certification planned.

Do you review sub-processors and require DPAs?

Sub-processors reviewed; a GDPR-compliant DPA is in place with 6 of 9. For the other 3 (LiveKit, Deepgram, AWS S3) it is being confirmed.

Do you perform vendor / third-party risk review before onboarding a sub-processor?

Each sub-processor is assessed for data handling, region and DPA terms before use; the list is published here.

Do you notify customers of sub-processor changes?

The sub-processor list is published with a subscribe-to-changes option so customers are notified of additions.

Do you support enterprise SSO (SAML 2.0 / OIDC)?

SAML 2.0 and OIDC federation for partner organisations.

Do you support SCIM user provisioning?

SCIM 2.0 (RFC 7644) joiner/mover/leaver with audit trail.

Is multi-factor authentication available and enforceable?

MFA with enforcement + step-up (AAL2) for sensitive operations.

Do you offer phishing-resistant authentication?

Passkey-first (WebAuthn, user verification).

Is access governed by least-privilege RBAC?

Role-based access; tenant isolation enforced at the database layer.

Is data encrypted in transit?

TLS 1.2 or later offered; HSTS for one year, subdomains included.

Is data encrypted at rest?

Database, storage and backups encrypted at rest (AES-256).

Is customer data logically isolated between tenants?

Postgres Row-Level Security across 100+ tables.

Is customer data resident in a specific region?

European Union (AWS eu-west-1); no relocation outside the EU.

Do you rate-limit authentication endpoints?

Atomic, auth-aware, fail-closed limiter (per-account + per-IP).

Do you monitor for anomalous / abusive activity?

Continuous anomaly detection every 5 min (alerting).

Do you have a vulnerability-disclosure policy?

Coordinated-disclosure policy + security.txt (RFC 9116).

Do you run a bug-bounty programme?

A VDP is published; a bounty programme is on the roadmap.

Do you commission independent penetration tests?

Internal security reviews today; third-party pen-test on the roadmap.

Do you maintain an audit log of security events?

Security-relevant events recorded to an append-only stream.

Do you support audit-log / SIEM export?

Append-only audit stream today; records available on request. Self-service SIEM export is on the roadmap.

Do you follow a change-management process for production changes?

Changes go through version control and review before release; database changes ship as reviewed migrations.

Do you follow a secure software development lifecycle (SDLC)?

Code review, automated checks and dependency hygiene in place; a formally attested SDLC is part of the SOC 2 / ISO roadmap.

Do you have a documented incident-response process?

Anomaly alerting and a defined breach-notification SLA are live; a fully documented IR runbook is being formalised alongside the SOC 2 programme.

Do you support GDPR data-subject requests (access, export, erasure)?

Self-service from in-app privacy settings.

Is a Data Processing Agreement available?

DPA with SCCs available to every customer.

Is customer data deleted on contract termination?

Deletion on request; defined retention windows.

Do you provide a data-deletion SLA / defined retention windows?

Deletion honoured on request; each data type has a defined retention window, not indefinite storage.

Is your sub-processor list published?

Published on this Trust Center with a subscribe-to-changes option.

Is there human oversight of AI-assisted decisions?

Club AI is assistive; a human always makes the hiring decision.

Are AI model sub-processors disclosed?

Named in the sub-processor table with region and data terms.

Do you address EU AI Act obligations for hiring AI?

Built for transparency, human oversight and against adverse impact (high-risk class).

Do you maintain encrypted backups?

Backups encrypted at rest.

Do you have a defined breach-notification SLA?

Within 72 hours of awareness (GDPR Art. 33/34).

Do you publish a real-time status page?

status.thequantumclub.com: live component health + historical uptime.