Pre-filled vendor security questionnaire.
If your procurement team needs a security questionnaire, this page answers the standard questions directly - no back-and-forth required. Each answer links to the primary source for verification.
Company & service overview
Is the vendor a legal entity with a registered address?
PartialKeyVault Edge is an early-stage technology company. Legal entity registration details will be published before general availability. Contact legal@keyvaultedge.com for current status.
Does the vendor carry cyber liability insurance?
PlannedCyber liability insurance is on the pre-GA checklist. Coverage will be in place before paying customers are onboarded at scale.
Is the service available under an enterprise SLA?
PlannedThere is no contractual uptime SLA yet. Service is best-effort on all plans, with live status at keyvaultedge.com/status. Enterprise customers can discuss availability terms with sales@keyvaultedge.com.
Data classification & storage
Does the vendor store customer API keys in plaintext?
NoNo. Keys are encrypted with AES-256-GCM before storage, and tokens carry them encrypted under a per-token data key wrapped by a master key held as a Worker secret, not in the database.
Encryption flowDoes the vendor log request Authorization headers?
NoUsage records hold the org, token ID, provider, method and path, status, latency and edge location. Authorization headers and request bodies are never logged.
Memory handlingIs data at rest encrypted?
YesAll customer data is encrypted at rest in Supabase (PostgreSQL with encryption-at-rest). Key envelopes are additionally encrypted at the application layer with AES-256-GCM.
Is data in transit encrypted?
YesAll public endpoints require TLS 1.2 or 1.3. HSTS is sent with a two-year max-age, includeSubDomains and preload. Upstream connections to API providers are https only.
TLS policyWhere is customer data stored geographically?
YesCustomer data is stored in Supabase (hosted PostgreSQL). The edge Worker runs on Cloudflare's global network; it keeps revocation, rate-limit and usage counters in Cloudflare KV and Durable Objects, and does not store provider keys at the edge.
Encryption & key management
What encryption standard is used for customer secrets?
YesAES-256-GCM with a random 96-bit IV, for both stored keys and token payloads. Data keys come from Web Crypto's CSPRNG on our server.
Are encryption keys stored separately from encrypted data?
YesYes. The master key and HMAC key are encrypted Worker secrets, separate from the database. A database compromise alone yields ciphertext. There is no cloud HSM in the current design.
Key managementDoes the vendor support customer-managed encryption keys (CMEK)?
PlannedOn the Enterprise roadmap: customers would supply their own key via AWS KMS, GCP Cloud KMS or Azure Key Vault. Not live yet. Today, the self-hosted proxy can run with the customer's own master key.
Is key rotation supported?
YesProvider keys can be rotated any time with rotation reminders in the dashboard; tokens can be revoked and re-issued. Rotating the master key requires re-issuing tokens, because the wrapped data key travels inside each token.
Access controls & identity
Can vendor employees access customer plaintext API keys?
NoNot through normal access: keys are never shown or logged, and the root keys are Worker secrets that can't be read back from the dashboard. Someone with deploy access to the Worker could in principle use those secrets; that access is limited to the founder.
Access modelIs MFA required for production infrastructure access?
PartialProduction access (Cloudflare, Supabase, Vercel, payment providers) is limited to the founder's accounts. A formal MFA-enforcement policy is part of the SOC 2 preparation.
Is production access logged?
YesAccess is logged at the application level (not just network level). Logs are retained and can be reviewed during a security audit.
Is database access protected by row-level security?
YesSupabase RLS is enforced. No employee query can return another customer's rows without an explicit RLS exception, which would be logged and alerted.
Are production deployments code-signed?
YesWorkers are deployed from signed commits on the main branch only. A hash-pinned version is deployed. Any modification to the deployed code triggers an alert in Cloudflare's audit trail.
Incident response
Does the vendor have a published incident response plan?
YesYes - the 7-step breach response playbook is published publicly, including timing commitments (T+15min customer notification, T+15min automatic token revocation, T+72hr post-mortem).
Breach response playbookWhat is the customer notification SLA for a confirmed breach?
Yes15 minutes. Affected customers are emailed within 15 minutes of a confirmed breach. Notification includes what happened, what data was exposed, what we've done, and what you should do.
Are tokens automatically revoked in a breach?
YesYes. All tokens involved in an incident are automatically revoked at the moment the breach is confirmed. No manual step is required.
Is there a public incident log?
YesYes - append-only. All security-relevant incidents are documented publicly with post-mortems.
Incident logDoes the vendor provide billing credits for breach periods?
YesYes. Any customer whose tokens were compromised in a confirmed breach receives a full billing credit for the affected period.
Vulnerability management
Is there a responsible disclosure programme?
YesYes - scope, rules of engagement, and disclosure timeline are published. Researchers can report to security@keyvaultedge.com.
Disclosure policyIs security.txt published per RFC 9116?
YesYes - available at /.well-known/security.txt with Contact, Expires, Policy, Acknowledgments, and Preferred-Languages fields.
security.txtHas the vendor completed a third-party penetration test?
PlannedScheduled prior to general availability. Summary report will be published on the Trust Center.
Does the vendor have a threat model?
YesYes - plain-English threat model is publicly available, covering defender objectives, adversary profiles, attack surface, and explicit out-of-scope scenarios.
Threat modelCompliance & certifications
Is the vendor SOC 2 certified?
PlannedSOC 2 Type I is targeted within 12 months of first paying customer. SOC 2 Type II to follow. Report will be available under NDA on request.
Is the vendor GDPR compliant?
PartialData is stored in the EU (primary). Privacy Policy and Data Processing Agreement (DPA) are in progress. Contact privacy@keyvaultedge.com to discuss your specific requirements.
Is a Data Processing Agreement (DPA) available?
PartialDPA is in preparation. Available for Enterprise customers on request. Email legal@keyvaultedge.com.
Is the vendor CCPA compliant?
PartialKeyVault Edge does not sell personal data. CCPA notices will be included in the Privacy Policy update currently in progress.
Sub-processors & supply chain
Is a sub-processor list publicly available?
YesYes - the full list of third parties that touch customer data is published on the Trust Center, including data touched and region.
Sub-processor listAre customers notified before new sub-processors are added?
YesPaid customers receive email notification before any new sub-processor becomes active.
Is Cloudflare used as the edge runtime?
YesYes - Cloudflare Workers is the execution environment for the edge proxy. Cloudflare's security posture and compliance certifications (ISO 27001, SOC 2, PCI DSS Level 1) are relevant to your assessment.
Business continuity & availability
Does the vendor have a Business Continuity Plan (BCP)?
PartialCloudflare Workers provides inherent geographic redundancy across 300+ PoPs. Formal BCP documentation is in progress for Enterprise plan customers.
What is the Recovery Time Objective (RTO) for the proxy?
YesCloudflare Worker deployments can be rolled back to a known-good hash in under two minutes. Cloudflare's own infrastructure has RTO of seconds for individual PoP failures.
Is there a public status page?
PlannedStatus page at status.keyvaultedge.com is on the near-term roadmap, backed by an independent uptime monitoring provider.
What is the target uptime SLA?
PlannedNo published uptime target yet; availability is best-effort on all plans. Live status is at keyvaultedge.com/status.
Need something not covered here?
Enterprise procurement evaluations often require custom documentation. We respond to security@keyvaultedge.com within one business day.