BordersHub Security Questionnaire

Pre-filled, self-attested answers organized by the control domains of the Cloud Security Alliance’s CAIQ v4. Question numbering is our own. “Partial” and “No” mark controls that are planned or not yet in place.

Download CSV

Yes: 45 Partial: 9 No: 6 N/A: 1

Audit & Assurance (A&A)

ID	Question	Answer	Notes
A&A-01	Has the service been independently audited or certified (e.g. SOC 2, ISO/IEC 27001)?	No	Not yet. BordersHub's security posture is self-attested in this questionnaire, the Trust Center and the Security Overview. Infrastructure providers' own certifications are listed in the Trust Center.
A&A-02	Are information security policies documented, approved and reviewed at least annually?	Yes	Information Security, Access Control, Incident Response, Backup and Recovery, and Vulnerability Management policies are approved by the Security Owner and reviewed at least annually. Available on request.

Application & Interface Security (AIS)

ID	Question	Answer	Notes
AIS-01	Are all code changes made through version control with automated build and test checks?	Yes	All changes go through GitHub pull requests; CI runs the build, automated tests and security scans on every change.
AIS-02	Is static application security testing (SAST) performed?	Yes	Semgrep (C#, secrets and Dockerfile rules) runs on every push, pull request and weekly.
AIS-03	Is the application protected against common web vulnerabilities (OWASP Top 10)?	Partial	Parameterized database queries (EF Core), output encoding by default, anti-forgery tokens on forms, server-side authorization on every request, SAST and dependency scanning. No independent penetration test has been performed yet.
AIS-04	Is the API authenticated and protected?	Yes	Read-only API using admin-issued bearer tokens: ~238 bits of randomness, shown once, stored as SHA-256 hashes, maximum one-year lifetime, revocable, rate limited to 120 requests per minute per token. Browser cookies are not accepted on the API.

Business Continuity & Operational Resilience (BCR)

ID	Question	Answer	Notes
BCR-01	Are backups of customer data performed regularly?	Yes	Daily automated backups of the database and uploaded files, retained for 30 days.
BCR-02	Are backups stored separately from the production environment?	Partial	Required for production by the Backup and Recovery Policy (copy to separate, access-restricted storage).
BCR-03	Are restores from backup tested?	Partial	Quarterly restore tests are required by policy; a documented restore procedure exists.
BCR-04	Are recovery objectives defined?	Yes	RPO 24 hours, RTO 24 hours.
BCR-05	Is there a documented business continuity and disaster recovery plan?	Partial	Backup and recovery procedures are documented; a broader business continuity plan is not yet in place.

Change Control & Configuration Management (CCC)

ID	Question	Answer	Notes
CCC-01	Are changes to production reviewed and tested before deployment?	Yes	Changes are merged through pull requests after CI passes (build, tests, NuGet vulnerability audit, Trivy, Semgrep); database changes are versioned EF Core migrations.
CCC-02	Are dependencies kept up to date?	Yes	Dependabot opens weekly update pull requests for NuGet packages, Docker base images and GitHub Actions.

Cryptography, Encryption & Key Management (CEK)

ID	Question	Answer	Notes
CEK-01	Is data encrypted in transit?	Yes	The service is served over HTTPS (TLS) with HTTP Strict Transport Security.
CEK-02	Is data encrypted at rest?	Partial	Stored data relies on the encryption-at-rest features of the hosting and storage providers listed in the Trust Center where they offer it. Encryption at rest is not yet confirmed for every data store.
CEK-03	Are user passwords stored using a strong one-way hash?	Yes	Salted, iterated PBKDF2 hashes via ASP.NET Core Identity; passwords are never stored in readable form.
CEK-04	Are API credentials stored securely?	Yes	API tokens are stored only as SHA-256 hashes and cannot be recovered after creation.
CEK-05	Are secrets kept out of source code?	Yes	Secrets are kept in environment configuration or the hosting provider's secret store; Trivy secret scanning runs on every change.
CEK-06	Are published documents protected against tampering?	Yes	Each published trust profile is stored as a record with a SHA-256 fingerprint and an ECDSA P-256 (ES256) signature made with the organization's own key. Signing keys are kept outside the database. Anyone can verify a record at /verify.

Datacenter Security (DCS)

ID	Question	Answer	Notes
DCS-01	Is physical security of datacenters ensured?	N/A	LamWorks operates no datacenters. The service runs on the infrastructure providers listed in the Trust Center, which are responsible for physical security.

Data Security & Privacy (DSP)

ID	Question	Answer	Notes
DSP-01	Is a privacy policy published?	Yes	Yes, at /privacy. It covers PIPEDA, Alberta PIPA, GDPR/UK GDPR and U.S. state laws.
DSP-02	Where is customer data hosted?	Yes	Canada.
DSP-03	Is customer data logically separated between customers?	Yes	Every record belongs to one organization; non-public data is returned only to that organization or to organizations it has explicitly approved.
DSP-04	Do customers control who can access their data?	Yes	Customers approve or revoke each trust relationship; revocation takes effect immediately. The public registry shows only basic identity particulars.
DSP-05	Is customer data deleted on termination?	Yes	Deleting an organization immediately removes its data from the service; residual backup copies expire within 30 days (Privacy Policy commitment: within 90 days).
DSP-06	Are data processing terms available?	Yes	Processor terms are included in the Terms of Service (section 12), with standard contractual clauses where required for transfers.
DSP-07	Are sub-processors disclosed?	Yes	Listed in the Trust Center.
DSP-08	Is customer data used to train AI models or sold?	No	Customer data is never sold or used to train AI models.
DSP-09	Are data subject requests supported?	Yes	Through the Privacy Officer; users can also update their own profile data and organizations can delete their data.
DSP-10	Is data classified?	Yes	Public, Internal, Customer Confidential and Secret, per the Information Security Policy.

Governance, Risk & Compliance (GRC)

ID	Question	Answer	Notes
GRC-01	Is there an owner accountable for information security and privacy?	Yes	The LamWorks Security Owner, who also acts as Privacy Officer.
GRC-02	Is a formal risk assessment performed regularly?	Partial	Security risks are reviewed with the annual policy review; a formal risk register is not yet maintained.

Human Resources (HRS)

ID	Question	Answer	Notes
HRS-01	Do personnel sign confidentiality agreements?	Yes	Required by the Information Security Policy before access is granted.
HRS-02	Are background checks performed?	No	Not currently performed.
HRS-03	Is security awareness training provided?	Partial	Personnel acknowledge the security policies; there is no formal training program yet.
HRS-04	Is access revoked promptly when personnel leave?	Yes	Within 24 hours, with rotation of any shared secrets they could reach.

Identity & Access Management (IAM)

ID	Question	Answer	Notes
IAM-01	Is multi-factor authentication available to customers?	Yes	TOTP authenticator apps.
IAM-02	Is MFA enforced for administrators?	Yes	Organization admins must set up MFA before they can use the application.
IAM-03	Can customers require MFA for all of their users?	Yes	Organization-wide MFA requirement in Settings.
IAM-04	Are password policy and account lockout configurable?	Yes	Minimum length, special characters, failed-attempt threshold and lockout duration per organization.
IAM-05	Is role-based access control supported?	Yes	Ten roles (Admin, Contributor, Approver, Governance, InfoSec, Risk, Auditor, Sales, Read-only, Billing user) with full, view-only or no access per section; roles also limit access to partners' full profiles and evidence.
IAM-06	Are sessions invalidated when a user is removed or their credentials change?	Yes	Sessions are invalidated at the next security check (within 30 minutes); evidence downloads re-verify the account on every request.
IAM-07	Is access to production restricted, with MFA, for the provider's personnel?	Yes	Limited to named personnel who need it; MFA on every access path (Access Control Policy).
IAM-08	Are access rights reviewed periodically?	Yes	Quarterly, per the Access Control Policy.
IAM-09	Is single sign-on (SAML/OIDC) supported?	No	Not currently supported.

Infrastructure & Virtualization Security (IVS)

ID	Question	Answer	Notes
IVS-01	Does the application run with least privilege?	Yes	The application container runs as a non-root user.
IVS-02	Is the database isolated from the public internet?	Partial	Required for production deployments; network rules are managed through the hosting provider.
IVS-03	Are container images scanned for vulnerabilities?	Yes	Trivy scans the built image in CI.

Logging & Monitoring (LOG)

ID	Question	Answer	Notes
LOG-01	Are user and administrator activities logged?	Yes	Sign-ins and failures, account and security changes, team changes, profile edits and approvals, evidence uploads, views and downloads, trust decisions, API token management and support activity, with actor, time, IP and user agent.
LOG-02	Are audit logs protected from modification?	Yes	Append-only: the application refuses changes and a database trigger rejects updates.
LOG-03	Can customers access their audit logs?	Yes	Searchable in the application and retrievable through the API.
LOG-04	Is there automated security monitoring and alerting (e.g. SIEM)?	No	Not yet; logs are reviewed during investigations.

Security Incident Management (SEF)

ID	Question	Answer	Notes
SEF-01	Is there a documented incident response plan?	Yes	Severity levels, response steps, notification rules and post-incident reviews.
SEF-02	Will customers be notified of incidents affecting their data?	Yes	Without undue delay after an incident is confirmed.
SEF-03	Are privacy breaches recorded?	Yes	Every privacy breach is recorded and kept for at least 24 months.

Supply Chain Management (STA)

ID	Question	Answer	Notes
STA-01	Are sub-processors selected and reviewed for security?	Partial	Chosen preferring independently certified providers, under written terms; reviewed annually.

Threat & Vulnerability Management (TVM)

ID	Question	Answer	Notes
TVM-01	Are dependencies scanned for known vulnerabilities?	Yes	NuGet vulnerability audit and Trivy on every change and weekly; high and critical findings fail the build.
TVM-02	Are remediation timelines defined?	Yes	Critical 7 days, High 30 days, Medium 90 days.
TVM-03	Has an independent penetration test been performed?	No	Not yet; planned before a SOC 2 or ISO/IEC 27001 audit or when a customer contract requires it.
TVM-04	Is there a vulnerability disclosure process?	Yes	Published in the Security Overview, with good-faith safe harbor.

Universal Endpoint Management (UEM)

ID	Question	Answer	Notes
UEM-01	Are personnel devices required to be encrypted, locked and patched?	Yes	Full-disk encryption, automatic screen lock and automatic security updates are required by the Information Security Policy.

This questionnaire is provided for information only and reflects LamWorks’s practices on the date it is viewed or downloaded. It does not create warranties beyond the Terms of Service.