Security questionnaire answers

Pre-filled answers to common vendor security questionnaires (CAIQ-Lite, SIG Lite style), written from how Sovaria actually works, with unknowns marked.

Updated Nov 12, 2026

These are our answers to the questions most vendor security reviews ask, grouped by the domains of the Cloud Security Alliance's Cloud Controls Matrix (CCM v4, a standard list of cloud security controls), so you can map them to a CAIQ-Lite (the CSA's short Consensus Assessments Initiative Questionnaire) or SIG Lite (the short Standardized Information Gathering questionnaire) form. The question wording is ours: this is not an official CSA or Shared Assessments document, and Sovaria holds no SOC 2 report or ISO 27001 certificate yet (Trust and compliance). Answers as of 12 November 2026.

Want it in your own form? Email tech@sovaria.in with "Security questionnaire" in the subject and attach it; we fill it in from these answers, free. Our policies and control map are available under NDA.

#Company and governance (GRC)

ID	Question	Answer	Detail
GRC-01	Who provides the service?	—	Sovaria Technologies Private Limited, a company registered in India (Jaipur), with two directors. Early access: production holds test accounts, and the company is pre-launch.
GRC-02	Do you have documented, approved information security policies?	Partly	Thirteen policies (information security, access control, change management, incident response, business continuity, vendors, data classification and retention, encryption, secure development, acceptable use, risk assessment, AI-assisted engineering, code of conduct) are written for how Sovaria really runs. They take effect when both directors sign them; that is pending.
GRC-03	Is there a named person responsible for security?	Yes	The CEO, Tejashvi Kumawat, is the Security Officer. The other director, Nikita Singh, has an oversight role (reviews his access, holds the break-glass document).
GRC-04	Do you run a risk assessment?	Partly	A risk register of 21 risks was assessed in November 2026; the board's sign-off is pending. It is reviewed yearly and after major changes.
GRC-05	Does senior management or a board oversee security?	Partly	The two directors are the board. A yearly management review and board minute are templated; the first one is pending.
GRC-06	Do you hold cyber insurance?	No	Sovaria holds no cyber liability insurance today.

#Audit and assurance (A&A)

ID	Question	Answer	Detail
A&A-01	Do you have a current independent audit report (SOC 2, ISO 27001)?	No	SOC 2 is in progress (readiness); no audit has started. See Trust and compliance.
A&A-02	Do you assess your own controls?	Yes	A control map of 57 controls with our own status for each, published on the trust center; full security code audits (latest 7 November 2026). Automated monthly evidence collectors are built; their first published run is pending.
A&A-03	Can customers audit you?	Yes	As in the DPA: we answer reasonable questionnaires, and where the law requires or after a breach you (or an independent auditor under confidentiality) may audit once a year with 30 days' notice.
A&A-04	Are findings tracked and fixed?	Yes	Every finding from a change review is fixed before merge, at every severity. Audit findings have fix deadlines by severity (critical 7 days, high 30, medium 90).

#Application and interface security (AIS)

ID	Question	Answer	Detail
AIS-01	Is every code change reviewed by someone other than its author before release?	Partly	Since 10 November 2026 every change is reviewed by someone who didn't write it, covering correctness, security, performance, reliability, tests, compatibility, privacy and more; every finding is fixed and re-reviewed until the verdict is MERGE, and the record names the exact code versions. The author is often an AI coding agent, and the reviewer is a person or a separate, independent AI review agent; the owner authorises every merge and deploy, and there is no second human approver yet. Branch protection that technically enforces this is planned.
AIS-02	Do you run automated security testing in your pipeline?	Not yet verified	CI includes secret scanning (Gitleaks), dependency audits (pip-audit, npm audit) and container image scanning (Trivy) with an SBOM and provenance. CI runs on a weekly schedule rather than on every push; we are confirming the scheduled runs are green.
AIS-03	Are all APIs authenticated and authorised?	Partly	Every request to project data carries a session, an API key or the project's public (anon) key and is checked against default-deny access policies and Postgres row-level security (How access is decided). Some endpoints are open by design: sign-up and sign-in, functions you choose to make public, public buckets, and requests made with the public key, which only get what your policies allow anyone.
AIS-04	How do you prevent injection?	Yes	Input is validated; SQL is parameterised; customer SQL runs under the caller's role with statement timeouts; error messages never echo input or internals.
AIS-05	Do you run penetration tests?	Partly	Our own automated penetration-test suite (tokens, injection, traversal, SSRF, rate limits, prompt injection, database escapes) is set up to run weekly against production with test accounts; verification of the schedule is pending. No independent third-party pentest yet; one is planned.
AIS-06	Do you protect AI features against prompt injection?	Yes	The Sovariq red-team suite (237 of 237 attack cases contained, 7 November 2026): content and tool output are treated as data, destructive tools need confirmation, and no secrets reach prompts.

#Business continuity and resilience (BCR)

ID	Question	Answer	Detail
BCR-01	Do you have a business continuity and disaster recovery plan?	Partly	Written for our one-server design, with recovery steps and a contact tree; sign-off pending. No full disaster-recovery drill has been run yet.
BCR-02	Do you back up customer data?	Yes	Daily encrypted backups. Point-in-time recovery for dedicated project databases (Pro and higher; at most a minute or two of changes lost) and for the platform database (Backups and recovery).
BCR-03	Are backups tested?	Not yet verified	Automatic monthly restore tests into a throwaway database are scheduled; we are confirming recent runs passed.
BCR-04	Is the service redundant across zones or regions?	No	One region (Mumbai), one main server, and one availability zone for the platform database. An off-site backup copy that can't be deleted is being set up.
BCR-05	What are your recovery targets?	Partly	Internal targets: platform database at most 5 minutes of data loss and 4 hours to restore; dedicated project databases a minute or two and 4 hours. They haven't been proven by a full drill, so they are not a commitment.
BCR-06	Do you offer an uptime SLA?	No	Not during early access. Availability and incidents are public on the status page.

#Change control (CCC)

ID	Question	Answer	Detail
CCC-01	Are production changes recorded?	Yes	All code and configuration is in git. One deploy script records each deploy (who, the code versions, the result) and emails it.
CCC-02	Can a bad change be rolled back?	Yes	Smoke tests run after each service is deployed, and a failure rolls back automatically.
CCC-03	Are development and production separate?	Partly	Development runs locally with no production data. There is no separate staging environment yet; production tests use dedicated test accounts.
CCC-04	How are emergency changes handled?	Yes	A focused review before the deploy, and the full review within 24 hours.

#Cryptography and keys (CEK)

ID	Question	Answer	Detail
CEK-01	Is data encrypted in transit?	Yes	TLS 1.2 and 1.3 only, HSTS with preload. Database connection strings require TLS.
CEK-02	Is data encrypted at rest?	Partly	The platform database storage, all backups (AES-256 before they leave the server; project database backups use AES-256-GCM), MFA secrets and stored credentials are encrypted. Encryption of the disks under project databases is being verified.
CEK-03	Can customers use their own keys?	Yes	Bring your own AWS KMS key for files and backups on eligible plans; revoking it makes them unreadable (Your own encryption key (BYOK)).
CEK-04	Are keys rotated?	Partly	Sign-in token keys rotate with overlap. A yearly rotation of high-value secrets is policy; the first recorded rotation is pending.
CEK-05	How are passwords stored?	Yes	bcrypt (cost 12), checked against known leaked passwords without sending them (k-anonymity), with lockout and rate limits.

#Data centre security (DCS)

ID	Question	Answer	Detail
DCS-01	Where is the service hosted?	—	Amazon Web Services, one region: Asia Pacific (Mumbai, ap-south-1), India. Other regions that appear in our code (Europe eu-west-1, US East us-east-1) are not offered. No other cloud is used.
DCS-02	How is physical security handled?	Yes	By AWS. Sovaria has no data centres or offices holding customer data. AWS publishes its own SOC 2 and ISO 27001 reports.

#Data security and privacy (DSP)

ID	Question	Answer	Detail
DSP-01	Where is customer data stored?	—	India: AWS Asia Pacific (Mumbai, ap-south-1), the only region production runs in. Other regions that appear in our code (Europe eu-west-1, US East us-east-1) are not offered. AI model providers process prompts in the United States, only when you use AI features. See the subprocessors.
DSP-02	Do staff access customer data?	Partly	Day to day, only through audited tools and time-limited support grants, for support, security or legal reasons; each such access is in your organization's audit log (`sov compliance audit-log --staff-access-only`). For emergencies the owner can also log in to the server with an SSH key (break-glass access); those logins are recorded in the server's security logs, not in your organization's audit log.
DSP-03	Is customer data used to train AI models?	No	Sovaria doesn't train models. Our default AI provider's API terms exclude training on API content; other providers are used only when you choose them. HIPAA mode turns AI features off.
DSP-04	Can customers export their data?	Yes	At any time, through the console, API and CLI; account holders can download their own data in Account › Privacy.
DSP-05	Is data deleted when a customer leaves?	Yes	Deleting an organization or project purges it from every service after the retention window; account erasure runs 30 days after a request; data leaves backups within 35 days. Records the law requires us to keep are kept.
DSP-06	Do you offer a Data Processing Agreement?	Yes	A public DPA with Standard Contractual Clauses; Enterprise customers can sign a copy. Counsel review is pending.
DSP-07	Do you publish subprocessors and notify changes?	Yes	A public list, with 30 days' notice by email before adding one.
DSP-08	Do you comply with the DPDP Act and GDPR?	Partly	Privacy notice, consent records, rights tooling, guardian consent for minors, a Grievance Officer and breach processes are in place. Counsel review is pending. Most DPDP Rules duties start around May 2027; we follow them now.
DSP-09	Is data classified?	Partly	Four classes in our data policy (sign-off pending). All customer content is treated as confidential.

#Human resources (HRS)

ID	Question	Answer	Detail
HRS-01	Are background checks done?	No	Not yet. Today the people with access are the two founders.
HRS-02	Do staff sign confidentiality agreements?	Partly	A confidentiality and IP agreement is written; signatures and a lawyer's review are pending.
HRS-03	Is there security awareness training?	Partly	An in-house course with a sign-off sheet is written; the first completion is pending.
HRS-04	Is access removed when someone leaves?	Yes	A same-day offboarding checklist covering every system. Nobody has left so far.

#Identity and access management (IAM)

ID	Question	Answer	Detail
IAM-01	Does everyone have their own account?	Partly	Yes for the Control Center and production. A generic administrator account on our code host is being removed or documented as a break-glass account.
IAM-02	Is MFA required for administrative access?	Partly	Yes for the Control Center: device certificate, password and one-time code. MFA on every account of our cloud, code-hosting and vendor consoles is unknown until our first access review; organization-wide 2FA enforcement on our code host is pending.
IAM-03	Do services run with least privilege?	Yes	Each Sovaria service has its own database and cache login with only the permissions it needs.
IAM-04	Are access rights reviewed regularly?	Partly	A quarterly review covering every system is defined and tooled; the first completed review is due by 31 December 2026.
IAM-05	What can customers use to protect their own accounts?	Yes	MFA (one-time codes and passkeys) for console accounts, organizations that require MFA, session timeouts, SAML SSO and SCIM, and scoped, revocable API keys (Organizations, members and roles, Multi-factor authentication, SAML single sign-on for your app (Okta, Entra ID, Google Workspace), SCIM provisioning (Okta, Entra ID, Google Workspace)).

#Infrastructure and virtualisation (IVS)

ID	Question	Answer	Detail
IVS-01	How are tenants isolated?	Yes	Each project has its own Postgres database; the tenant comes from the session or key; an isolation matrix checks one account can't reach another's data (How we secure and test the platform).
IVS-02	Is customer code sandboxed?	Yes	Functions run in gVisor with a syscall filter, no route to our internal network, and outbound calls only where you allow them.
IVS-03	Is the network segmented and filtered?	Partly	Host firewall, request filtering (WAF), rate limits and an egress proxy. Internal network segmentation between our own services is planned.
IVS-04	Are hosts patched?	Yes	Security updates install automatically; containers run as non-root with resource caps.

#Logging and monitoring (LOG)

ID	Question	Answer	Detail
LOG-01	Can customers see an audit log?	Yes	A tamper-evident (hash-chained) audit log per organization, with export and verification (Audit log).
LOG-02	Are security logs kept at least a year?	Not yet verified	A daily encrypted archive of security logs, kept 400 days in India, is set up; we are confirming it runs on production. Platform container logs are kept 2 days.
LOG-03	Is the platform monitored with alerting?	Partly	Checks every 5 minutes open incidents and alert the on-call engineer. Alerting that works even when the main server is down is not installed yet.
LOG-04	Are clocks synchronised?	Yes	With the Indian national time servers, as CERT-In requires.

#Incident management (SEF)

ID	Question	Answer	Detail
SEF-01	Do you have an incident response plan?	Partly	Written, with roles, a first-hour checklist, contact sheet and notice templates; sign-off and the first tabletop exercise are pending.
SEF-02	Will you tell us about a breach of our data?	Yes	Without undue delay, aiming for 24 hours after we become aware, with what we know (DPA).
SEF-03	Do you notify regulators?	Yes	CERT-In within 6 hours for reportable incidents (in force). The Data Protection Board of India without delay, with a detailed report within 72 hours, where Sovaria is the data fiduciary: a duty from May 2027 under the DPDP Rules, which we follow now. Whether our CERT-In point of contact registration is complete is being confirmed.
SEF-04	Is there a public status page and vulnerability disclosure process?	Yes	Status page; Reporting a vulnerability with a reply within 2 business days.

#Supply chain and third parties (STA)

ID	Question	Answer	Detail
STA-01	Do you keep a vendor inventory?	Yes	One register; the public subprocessor list is checked against it by a test.
STA-02	Do you review your vendors' security?	Partly	Vendors are chosen for their security reports; collecting each critical vendor's current report is under way.
STA-03	Is the shared responsibility documented?	Yes	Shared responsibility.
STA-04	Are your builds signed?	Partly	CI-built images are signed and checked before they run; some services can still be built on the server, and moving all of them to signed CI images is under way.

#Threat and vulnerability management (TVM)

ID	Question	Answer	Detail
TVM-01	Do you have deadlines for fixing vulnerabilities?	Partly	Critical 7 days, high 30, medium 90. Measuring them automatically is planned.
TVM-02	Do you scan dependencies and images?	Not yet verified	See AIS-02.
TVM-03	Is malware scanning available?	Partly	Uploads can be scanned for malware. Staff laptops have no central endpoint management yet.

#Endpoints (UEM)

ID	Question	Answer	Detail
UEM-01	Are staff devices encrypted and managed?	Unknown	Policy requires full-disk encryption, screen lock, updates and a firewall on every laptop with production access. Disk encryption hasn't been verified yet, and there is no device management (MDM) yet.