# Security questionnaire answers
Source: https://sovaria.in/docs/security-questionnaire

Pre-filled answers to common vendor security questionnaires (CAIQ-Lite, SIG Lite style), written from how Sovaria actually works, with unknowns marked.

These are our answers to the questions most vendor security reviews ask, grouped by the domains of the Cloud Security Alliance's Cloud Controls Matrix (CCM v4, a standard list of cloud security controls), so you can map them to a CAIQ-Lite (the CSA's short Consensus Assessments Initiative Questionnaire) or SIG Lite (the short Standardized Information Gathering questionnaire) form. The question wording is ours: this is not an official CSA or Shared Assessments document, and Sovaria holds no SOC 2 report or ISO 27001 certificate yet ([Trust and compliance](https://sovaria.in/docs/trust)). Answers as of 12 November 2026.

> **How to read the answers:** **Yes**: in place and checked. **Partly**: some of it is in place; the detail says which part. **No**: we don't do this. **Not yet verified**: built, but we haven't confirmed on production that it runs as designed. **Unknown**: we haven't checked, so we won't guess. Policies are written and waiting for our directors' signatures, so "documented" answers say "Partly" until they are signed.

Want it in your own form? Email **tech@sovaria.in** with "Security questionnaire" in the subject and attach it; we fill it in from these answers, free. Our policies and control map are available under NDA.

## Company and governance (GRC)

| ID | Question | Answer | Detail |
|---|---|---|---|
| GRC-01 | Who provides the service? | — | Sovaria Technologies Private Limited, a company registered in India (Jaipur), with two directors. Early access: production holds test accounts, and the company is pre-launch. |
| GRC-02 | Do you have documented, approved information security policies? | Partly | Thirteen policies (information security, access control, change management, incident response, business continuity, vendors, data classification and retention, encryption, secure development, acceptable use, risk assessment, AI-assisted engineering, code of conduct) are written for how Sovaria really runs. They take effect when both directors sign them; that is pending. |
| GRC-03 | Is there a named person responsible for security? | Yes | The CEO, Tejashvi Kumawat, is the Security Officer. The other director, Nikita Singh, has an oversight role (reviews his access, holds the break-glass document). |
| GRC-04 | Do you run a risk assessment? | Partly | A risk register of 21 risks was assessed in November 2026; the board's sign-off is pending. It is reviewed yearly and after major changes. |
| GRC-05 | Does senior management or a board oversee security? | Partly | The two directors are the board. A yearly management review and board minute are templated; the first one is pending. |
| GRC-06 | Do you hold cyber insurance? | No | Sovaria holds no cyber liability insurance today. |

## Audit and assurance (A&A)

| ID | Question | Answer | Detail |
|---|---|---|---|
| A&A-01 | Do you have a current independent audit report (SOC 2, ISO 27001)? | No | SOC 2 is in progress (readiness); no audit has started. See [Trust and compliance](https://sovaria.in/docs/trust). |
| A&A-02 | Do you assess your own controls? | Yes | A control map of 57 controls with our own status for each, published on the [trust center](https://sovaria.in/trust); full security code audits (latest 7 November 2026). Automated monthly evidence collectors are built; their first published run is pending. |
| A&A-03 | Can customers audit you? | Yes | As in the [DPA](https://sovaria.in/dpa): we answer reasonable questionnaires, and where the law requires or after a breach you (or an independent auditor under confidentiality) may audit once a year with 30 days' notice. |
| A&A-04 | Are findings tracked and fixed? | Yes | Every finding from a change review is fixed before merge, at every severity. Audit findings have fix deadlines by severity (critical 7 days, high 30, medium 90). |

## Application and interface security (AIS)

| ID | Question | Answer | Detail |
|---|---|---|---|
| AIS-01 | Is every code change reviewed by someone other than its author before release? | Partly | Since 10 November 2026 every change is reviewed by someone who didn't write it, covering correctness, security, performance, reliability, tests, compatibility, privacy and more; every finding is fixed and re-reviewed until the verdict is MERGE, and the record names the exact code versions. The author is often an AI coding agent, and the reviewer is a person or a separate, independent AI review agent; the owner authorises every merge and deploy, and there is no second human approver yet. Branch protection that technically enforces this is planned. |
| AIS-02 | Do you run automated security testing in your pipeline? | Not yet verified | CI includes secret scanning (Gitleaks), dependency audits (pip-audit, npm audit) and container image scanning (Trivy) with an SBOM and provenance. CI runs on a weekly schedule rather than on every push; we are confirming the scheduled runs are green. |
| AIS-03 | Are all APIs authenticated and authorised? | Partly | Every request to project data carries a session, an API key or the project's public (anon) key and is checked against default-deny access policies and Postgres row-level security ([How access is decided](https://sovaria.in/docs/access-model)). Some endpoints are open by design: sign-up and sign-in, functions you choose to make public, public buckets, and requests made with the public key, which only get what your policies allow anyone. |
| AIS-04 | How do you prevent injection? | Yes | Input is validated; SQL is parameterised; customer SQL runs under the caller's role with statement timeouts; error messages never echo input or internals. |
| AIS-05 | Do you run penetration tests? | Partly | Our own automated penetration-test suite (tokens, injection, traversal, SSRF, rate limits, prompt injection, database escapes) is set up to run weekly against production with test accounts; verification of the schedule is pending. No independent third-party pentest yet; one is planned. |
| AIS-06 | Do you protect AI features against prompt injection? | Yes | The Sovariq red-team suite (237 of 237 attack cases contained, 7 November 2026): content and tool output are treated as data, destructive tools need confirmation, and no secrets reach prompts. |

## Business continuity and resilience (BCR)

| ID | Question | Answer | Detail |
|---|---|---|---|
| BCR-01 | Do you have a business continuity and disaster recovery plan? | Partly | Written for our one-server design, with recovery steps and a contact tree; sign-off pending. No full disaster-recovery drill has been run yet. |
| BCR-02 | Do you back up customer data? | Yes | Daily encrypted backups. Point-in-time recovery for dedicated project databases (Pro and higher; at most a minute or two of changes lost) and for the platform database ([Backups and recovery](https://sovaria.in/docs/backups-and-recovery)). |
| BCR-03 | Are backups tested? | Not yet verified | Automatic monthly restore tests into a throwaway database are scheduled; we are confirming recent runs passed. |
| BCR-04 | Is the service redundant across zones or regions? | No | One region (Mumbai), one main server, and one availability zone for the platform database. An off-site backup copy that can't be deleted is being set up. |
| BCR-05 | What are your recovery targets? | Partly | Internal targets: platform database at most 5 minutes of data loss and 4 hours to restore; dedicated project databases a minute or two and 4 hours. They haven't been proven by a full drill, so they are not a commitment. |
| BCR-06 | Do you offer an uptime SLA? | No | Not during early access. Availability and incidents are public on the [status page](https://sovaria.in/status). |

## Change control (CCC)

| ID | Question | Answer | Detail |
|---|---|---|---|
| CCC-01 | Are production changes recorded? | Yes | All code and configuration is in git. One deploy script records each deploy (who, the code versions, the result) and emails it. |
| CCC-02 | Can a bad change be rolled back? | Yes | Smoke tests run after each service is deployed, and a failure rolls back automatically. |
| CCC-03 | Are development and production separate? | Partly | Development runs locally with no production data. There is no separate staging environment yet; production tests use dedicated test accounts. |
| CCC-04 | How are emergency changes handled? | Yes | A focused review before the deploy, and the full review within 24 hours. |

## Cryptography and keys (CEK)

| ID | Question | Answer | Detail |
|---|---|---|---|
| CEK-01 | Is data encrypted in transit? | Yes | TLS 1.2 and 1.3 only, HSTS with preload. Database connection strings require TLS. |
| CEK-02 | Is data encrypted at rest? | Partly | The platform database storage, all backups (AES-256 before they leave the server; project database backups use AES-256-GCM), MFA secrets and stored credentials are encrypted. Encryption of the disks under project databases is being verified. |
| CEK-03 | Can customers use their own keys? | Yes | Bring your own AWS KMS key for files and backups on eligible plans; revoking it makes them unreadable ([Your own encryption key (BYOK)](https://sovaria.in/docs/encryption-keys)). |
| CEK-04 | Are keys rotated? | Partly | Sign-in token keys rotate with overlap. A yearly rotation of high-value secrets is policy; the first recorded rotation is pending. |
| CEK-05 | How are passwords stored? | Yes | bcrypt (cost 12), checked against known leaked passwords without sending them (k-anonymity), with lockout and rate limits. |

## Data centre security (DCS)

| ID | Question | Answer | Detail |
|---|---|---|---|
| DCS-01 | Where is the service hosted? | — | Amazon Web Services, one region: Asia Pacific (Mumbai, ap-south-1), India. Other regions that appear in our code (Europe eu-west-1, US East us-east-1) are not offered. No other cloud is used. |
| DCS-02 | How is physical security handled? | Yes | By AWS. Sovaria has no data centres or offices holding customer data. AWS publishes its own SOC 2 and ISO 27001 reports. |

## Data security and privacy (DSP)

| ID | Question | Answer | Detail |
|---|---|---|---|
| DSP-01 | Where is customer data stored? | — | India: AWS Asia Pacific (Mumbai, ap-south-1), the only region production runs in. Other regions that appear in our code (Europe eu-west-1, US East us-east-1) are not offered. AI model providers process prompts in the United States, only when you use AI features. See the [subprocessors](https://sovaria.in/subprocessors). |
| DSP-02 | Do staff access customer data? | Partly | Day to day, only through audited tools and time-limited support grants, for support, security or legal reasons; each such access is in your organization's audit log (`sov compliance audit-log --staff-access-only`). For emergencies the owner can also log in to the server with an SSH key (break-glass access); those logins are recorded in the server's security logs, not in your organization's audit log. |
| DSP-03 | Is customer data used to train AI models? | No | Sovaria doesn't train models. Our default AI provider's API terms exclude training on API content; other providers are used only when you choose them. HIPAA mode turns AI features off. |
| DSP-04 | Can customers export their data? | Yes | At any time, through the console, API and CLI; account holders can download their own data in Account › Privacy. |
| DSP-05 | Is data deleted when a customer leaves? | Yes | Deleting an organization or project purges it from every service after the retention window; account erasure runs 30 days after a request; data leaves backups within 35 days. Records the law requires us to keep are kept. |
| DSP-06 | Do you offer a Data Processing Agreement? | Yes | A public [DPA](https://sovaria.in/dpa) with Standard Contractual Clauses; Enterprise customers can sign a copy. Counsel review is pending. |
| DSP-07 | Do you publish subprocessors and notify changes? | Yes | A public list, with 30 days' notice by email before adding one. |
| DSP-08 | Do you comply with the DPDP Act and GDPR? | Partly | Privacy notice, consent records, rights tooling, guardian consent for minors, a Grievance Officer and breach processes are in place. Counsel review is pending. Most DPDP Rules duties start around May 2027; we follow them now. |
| DSP-09 | Is data classified? | Partly | Four classes in our data policy (sign-off pending). All customer content is treated as confidential. |

## Human resources (HRS)

| ID | Question | Answer | Detail |
|---|---|---|---|
| HRS-01 | Are background checks done? | No | Not yet. Today the people with access are the two founders. |
| HRS-02 | Do staff sign confidentiality agreements? | Partly | A confidentiality and IP agreement is written; signatures and a lawyer's review are pending. |
| HRS-03 | Is there security awareness training? | Partly | An in-house course with a sign-off sheet is written; the first completion is pending. |
| HRS-04 | Is access removed when someone leaves? | Yes | A same-day offboarding checklist covering every system. Nobody has left so far. |

## Identity and access management (IAM)

| ID | Question | Answer | Detail |
|---|---|---|---|
| IAM-01 | Does everyone have their own account? | Partly | Yes for the Control Center and production. A generic administrator account on our code host is being removed or documented as a break-glass account. |
| IAM-02 | Is MFA required for administrative access? | Partly | Yes for the Control Center: device certificate, password and one-time code. MFA on every account of our cloud, code-hosting and vendor consoles is **unknown** until our first access review; organization-wide 2FA enforcement on our code host is pending. |
| IAM-03 | Do services run with least privilege? | Yes | Each Sovaria service has its own database and cache login with only the permissions it needs. |
| IAM-04 | Are access rights reviewed regularly? | Partly | A quarterly review covering every system is defined and tooled; the first completed review is due by 31 December 2026. |
| IAM-05 | What can customers use to protect their own accounts? | Yes | MFA (one-time codes and passkeys) for console accounts, organizations that require MFA, session timeouts, SAML SSO and SCIM, and scoped, revocable API keys ([Organizations, members and roles](https://sovaria.in/docs/organizations), [Multi-factor authentication](https://sovaria.in/docs/mfa), [SAML single sign-on for your app (Okta, Entra ID, Google Workspace)](https://sovaria.in/docs/saml-sso), [SCIM provisioning (Okta, Entra ID, Google Workspace)](https://sovaria.in/docs/scim-provisioning)). |

## Infrastructure and virtualisation (IVS)

| ID | Question | Answer | Detail |
|---|---|---|---|
| IVS-01 | How are tenants isolated? | Yes | Each project has its own Postgres database; the tenant comes from the session or key; an isolation matrix checks one account can't reach another's data ([How we secure and test the platform](https://sovaria.in/docs/platform-security#isolation)). |
| IVS-02 | Is customer code sandboxed? | Yes | Functions run in gVisor with a syscall filter, no route to our internal network, and outbound calls only where you allow them. |
| IVS-03 | Is the network segmented and filtered? | Partly | Host firewall, request filtering (WAF), rate limits and an egress proxy. Internal network segmentation between our own services is planned. |
| IVS-04 | Are hosts patched? | Yes | Security updates install automatically; containers run as non-root with resource caps. |

## Logging and monitoring (LOG)

| ID | Question | Answer | Detail |
|---|---|---|---|
| LOG-01 | Can customers see an audit log? | Yes | A tamper-evident (hash-chained) audit log per organization, with export and verification ([Audit log](https://sovaria.in/docs/audit-logs)). |
| LOG-02 | Are security logs kept at least a year? | Not yet verified | A daily encrypted archive of security logs, kept 400 days in India, is set up; we are confirming it runs on production. Platform container logs are kept 2 days. |
| LOG-03 | Is the platform monitored with alerting? | Partly | Checks every 5 minutes open incidents and alert the on-call engineer. Alerting that works even when the main server is down is not installed yet. |
| LOG-04 | Are clocks synchronised? | Yes | With the Indian national time servers, as CERT-In requires. |

## Incident management (SEF)

| ID | Question | Answer | Detail |
|---|---|---|---|
| SEF-01 | Do you have an incident response plan? | Partly | Written, with roles, a first-hour checklist, contact sheet and notice templates; sign-off and the first tabletop exercise are pending. |
| SEF-02 | Will you tell us about a breach of our data? | Yes | Without undue delay, aiming for 24 hours after we become aware, with what we know ([DPA](https://sovaria.in/dpa)). |
| SEF-03 | Do you notify regulators? | Yes | CERT-In within 6 hours for reportable incidents (in force). The Data Protection Board of India without delay, with a detailed report within 72 hours, where Sovaria is the data fiduciary: a duty from May 2027 under the DPDP Rules, which we follow now. Whether our CERT-In point of contact registration is complete is being confirmed. |
| SEF-04 | Is there a public status page and vulnerability disclosure process? | Yes | [Status page](https://sovaria.in/status); [Reporting a vulnerability](https://sovaria.in/docs/vulnerability-disclosure) with a reply within 2 business days. |

## Supply chain and third parties (STA)

| ID | Question | Answer | Detail |
|---|---|---|---|
| STA-01 | Do you keep a vendor inventory? | Yes | One register; the public subprocessor list is checked against it by a test. |
| STA-02 | Do you review your vendors' security? | Partly | Vendors are chosen for their security reports; collecting each critical vendor's current report is under way. |
| STA-03 | Is the shared responsibility documented? | Yes | [Shared responsibility](https://sovaria.in/docs/shared-responsibility). |
| STA-04 | Are your builds signed? | Partly | CI-built images are signed and checked before they run; some services can still be built on the server, and moving all of them to signed CI images is under way. |

## Threat and vulnerability management (TVM)

| ID | Question | Answer | Detail |
|---|---|---|---|
| TVM-01 | Do you have deadlines for fixing vulnerabilities? | Partly | Critical 7 days, high 30, medium 90. Measuring them automatically is planned. |
| TVM-02 | Do you scan dependencies and images? | Not yet verified | See AIS-02. |
| TVM-03 | Is malware scanning available? | Partly | Uploads can be scanned for malware. Staff laptops have no central endpoint management yet. |

## Endpoints (UEM)

| ID | Question | Answer | Detail |
|---|---|---|---|
| UEM-01 | Are staff devices encrypted and managed? | Unknown | Policy requires full-disk encryption, screen lock, updates and a firewall on every laptop with production access. Disk encryption hasn't been verified yet, and there is no device management (MDM) yet. |