CAIQ-Lite — Pre-answered Security Questionnaire

Meridian Vertex LLC, doing business as LicensePulse — Last updated: July 31, 2026

This document pre-answers the most common security questions enterprise procurement teams ask. It is modeled on the Cloud Security Alliance's CAIQ-Lite (Consensus Assessments Initiative Questionnaire — Lite). Use it as a starting point when a prospect sends a security questionnaire.

1. Application & Interface Security

# Question Answer
AIS-01 Are applications designed in accordance with industry-accepted standards (e.g. OWASP)? Yes. OWASP Top 10 awareness is part of code review. We use parameterized queries (SQL injection), output encoding (XSS), CSRF tokens on state-changing requests, secure session management, and bcrypt for passwords.
AIS-02 Is data input/output validation performed? Yes. Pydantic schemas validate all API input; output is JSON-serialized through typed models.
AIS-03 Is the application protected by a Web Application Firewall (WAF)? Yes. Cloudflare WAF in front of https://app.licensepulse.app.

2. Audit Assurance & Compliance

# Question Answer
AAC-01 Do you maintain SOC 2 reports? No — not certified, and we will not imply otherwise. The controls a SOC 2 audit examines are built and running (append-only audit log, MFA, encryption in transit and at rest, per-tenant isolation, RBAC, documented incident response). We begin a Type 1 audit when a customer requires it.
AAC-02 Do you have ISO 27001 certification? Not at this time.
AAC-03 Do you support customer audits? Yes — see Section 8 of our DPA.

3. Business Continuity & Operational Resilience

# Question Answer
BCR-01 Do you have a documented Business Continuity Plan (BCP)? Yes. Reviewed annually.
BCR-02 What is your RTO / RPO? RTO 4 hours / RPO 24 hours.
BCR-03 Are backups encrypted? Yes. AES-256 at rest.
BCR-04 Do you test restoration? Quarterly from launch. Backups and PITR are configured; drill history begins at general availability.

4. Change Control & Configuration Management

# Question Answer
CCC-01 Are code changes peer-reviewed before deployment? Yes. All changes go through pull-request review.
CCC-02 Do you use version control? Yes. Git, with branch protection on main.
CCC-03 Are dependencies tracked and scanned for vulnerabilities? Yes. GitHub Dependabot + Renovate; security patches applied within 30 days of release.

5. Data Security & Information Lifecycle Management

# Question Answer
DSI-01 Is Customer Data encrypted in transit? Yes. TLS 1.2+.
DSI-02 Is Customer Data encrypted at rest? Yes. AES-256 (Render-managed).
DSI-03 Is data isolated by tenant? Yes. All queries scoped by org_id; there is no shared dataset.
DSI-04 What is the data retention policy? Active during the term + 30 days for export + 90 days for backup ageout. See Privacy Policy §6.
DSI-05 Do you offer data export? Yes. CSV/JSON export from in-app, plus REST API.
DSI-06 Do you delete data on termination? Yes. Within 30 days of termination from active systems; 90 days from backups.

6. Encryption & Key Management

# Question Answer
EKM-01 Are encryption keys managed by a separate party from the data? Yes — Render manages volume-level encryption keys; application-level secrets (JWT signing key, OAuth client secrets) are stored in Render's environment variable vault, separate from the database.
EKM-02 Is there a key rotation policy? JWT signing key: rotated annually or on compromise. OAuth client secrets: rotated on demand.

7. Governance & Risk Management

# Question Answer
GRM-01 Is there an information security policy? Yes — internal document, summarized publicly at https://licensepulse.app/trust.
GRM-02 Are personnel background-checked? Yes for full-time hires.
GRM-03 Do personnel sign confidentiality / NDA? Yes — in employment agreements.

8. Human Resources Security

# Question Answer
HRS-01 Is security awareness training provided? Yes — annually + on hire.
HRS-02 Is access removed promptly on termination? Yes — same business day.

9. Identity & Access Management

# Question Answer
IAM-01 Do you support SSO (SAML / OIDC)? On the roadmap (target: within 6 months). Today: email/password with strong policy.
IAM-02 Do you support MFA? On the roadmap. TOTP support targeted within 3 months.
IAM-03 Are credentials hashed at rest? Yes. Passwords: bcrypt. Agent API keys: SHA-256.
IAM-04 Are there role-based access controls? Yes. Owner / Admin / Viewer with defined permissions.
IAM-05 Are administrative actions logged? Yes.

10. Infrastructure & Virtualization Security

# Question Answer
IVS-01 Where is the infrastructure hosted? Render.com, US-Oregon region.
IVS-02 Is the infrastructure SOC 2 / ISO 27001 attested? Render is SOC 2 Type II attested.
IVS-03 Is there network segmentation? Yes — public web service is the only ingress; database is not internet-exposed.

11. Interoperability & Portability

# Question Answer
IPY-01 Can Customer export data in a standard format? Yes. CSV, JSON, and PDF for contracts.
IPY-02 Is there a documented API? Yes. OpenAPI spec at https://app.licensepulse.app/docs.

12. Mobile Security

# Question Answer
MOS-01 Is there a native mobile app? No — the web application is responsive and works on mobile browsers.

13. Security Incident Management, E-Discovery & Cloud Forensics

# Question Answer
SEF-01 Is there a documented incident response plan? Yes.
SEF-02 What is the breach notification timeline? 72 hours from confirmed discovery.
SEF-03 Will you provide a post-mortem? Yes, within 30 days.
SEF-04 Will you support legal-hold / e-discovery requests? Yes, on lawful request and in accordance with the DPA.

14. Supply Chain Management, Transparency & Accountability

# Question Answer
STA-01 Do you maintain a list of sub-processors? Yes — at https://licensepulse.app/subprocessors.
STA-02 Do sub-processors sign DPAs with you? Yes.
STA-03 Do you give advance notice of new sub-processors? Yes — 14 days minimum.

15. Threat & Vulnerability Management

# Question Answer
TVM-01 Are there regular vulnerability scans? Yes — automated dependency scans on every build.
TVM-02 Are penetration tests performed? Annually (next scheduled within first year of operation). Reports available under NDA.
TVM-03 Is there a vulnerability disclosure program? Yes — security@licensepulse.app with 5-business-day response SLA.

Out-of-scope

The Service is not authorized for:

Customers must not upload such data. If you require any of the above, contact us before contracting.

Contact

Security questions: security@licensepulse.app General security correspondence: legal@licensepulse.app