CAIQ-Lite: Pre-answered Security Questionnaire

Meridian Vertex LLC, doing business as LicensePulse. Last updated: October 28, 2026

This document pre-answers the most common security questions enterprise procurement teams ask. It is modeled on the Cloud Security Alliance's CAIQ-Lite (the Lite version of the Consensus Assessments Initiative Questionnaire). Use it as a starting point when a prospect sends a security questionnaire.

LicensePulse is an early-stage, founder-operated company. Where a control is not in place, this document says so. Our Trust page lists what is shipped, what is in progress and what is planned.

1. Application & Interface Security

# Question Answer
AIS-01 Are applications designed in accordance with industry-accepted standards (e.g. OWASP)? Partially. Development follows OWASP Top 10 practices: ORM-parameterized queries, framework output encoding, bcrypt for passwords, organization-scoped authorization checks with automated cross-tenant tests. The API authenticates with bearer tokens rather than cookies, so CSRF tokens are not used. There is no formal secure-development programme yet.
AIS-02 Is data input/output validation performed? Yes. Pydantic schemas validate API input. Account endpoints return typed response models.
AIS-03 Is the application protected by a Web Application Firewall (WAF)? No dedicated WAF rule set is maintained by us. Traffic to our sites passes through Cloudflare's edge network.

2. Audit Assurance & Compliance

# Question Answer
AAC-01 Do you maintain SOC 2 reports? No, not certified, and no audit is scheduled.
AAC-02 Do you have ISO 27001 certification? No.
AAC-03 Do you support customer audits? Yes. See Section 8 of our DPA.

3. Business Continuity & Operational Resilience

# Question Answer
BCR-01 Do you have a documented Business Continuity Plan (BCP)? No. A written plan has not been produced yet.
BCR-02 What is your RTO / RPO? Not stated. We do not publish recovery objectives.
BCR-03 Are backups encrypted? At rest, by the storage provider. Nightly off-site backups are stored with a separate object-storage provider, which encrypts them at rest. We do not yet encrypt them ourselves before upload; that step is built and tested but not yet switched on in production. The managed database volume is encrypted at rest by our hosting provider (Render).
BCR-04 Do you test restoration? Yes. On 18 October 2026 we restored both an off-site backup and a point-in-time recovery into isolated databases, and every table matched production. The backup job can also restore each new backup into an empty scratch database and compare it with the source.

4. Change Control & Configuration Management

# Question Answer
CCC-01 Are code changes peer-reviewed before deployment? Not mandatory. Changes are made by the founders in Git; a second-person review is not enforced. CI runs the backend test suite on every pull request and every push to main, but passing it is not yet required before merge.
CCC-02 Do you use version control? Yes. Git (GitHub, private repository).
CCC-03 Are dependencies tracked and scanned for vulnerabilities? Yes. Dependencies are pinned in version control. CI runs pip-audit (Python) and npm audit (frontend) on every pull request and every push to main. Passing these checks is not yet required before merge.

5. Data Security & Information Lifecycle Management

# Question Answer
DSI-01 Is Customer Data encrypted in transit? Yes. HTTPS only, with HTTP redirected and HSTS set; TLS 1.2 and 1.3 are offered.
DSI-02 Is Customer Data encrypted at rest? Yes, at the volume level by our hosting provider (Render), using provider-managed keys. OAuth tokens are additionally encrypted at the application layer. Other fields (including MFA secrets and uploaded contract files) are not additionally application-encrypted.
DSI-03 Is data isolated by tenant? Logically. Customers share one database; every organization-scoped API route checks membership and that requested objects belong to that organization, and automated tests cover cross-tenant access.
DSI-04 What is the data retention policy? Active during the term plus 30 days for export, then deletion from active systems as described in the Privacy Policy §6. There is no automated retention purge; deletion is carried out by our team.
DSI-05 Do you offer data export? Yes. CSV exports in-app (portfolio, usage, savings, alerts); contract files can be downloaded individually. There is no public REST API.
DSI-06 Do you delete data on termination? Yes, by our team, within 30 days of termination from active systems.

6. Encryption & Key Management

# Question Answer
EKM-01 Are encryption keys managed by a separate party from the data? Render manages volume-level encryption keys. Application secrets (JWT signing key, OAuth-token encryption key, OAuth client secrets) are held in Render's environment configuration, separate from the database.
EKM-02 Is there a key rotation policy? No formal rotation schedule. Keys are rotated on suspected compromise.

7. Governance & Risk Management

# Question Answer
GRM-01 Is there an information security policy? Not as a formal written policy. Our controls are stated publicly at https://licensepulse.app/trust.html.
GRM-02 Are personnel background-checked? No formal background-check programme. The company is founder-operated.
GRM-03 Do personnel sign confidentiality / NDA? No formal programme. Production access is limited to the founders.

8. Human Resources Security

# Question Answer
HRS-01 Is security awareness training provided? No formal programme.
HRS-02 Is access removed promptly on termination? Yes. Production access is limited to the founders, and any other access is revoked on departure.

9. Identity & Access Management

# Question Answer
IAM-01 Do you support SSO (SAML / OIDC)? No. Not available, and no delivery date is committed. Today: email and password (minimum 12 characters).
IAM-02 Do you support MFA? Yes. Per-user TOTP with single-use backup codes. An Owner can require it for the whole organization through the API; there is no switch for it in the app yet.
IAM-03 Are credentials hashed at rest? Yes. Passwords and MFA backup codes: bcrypt. Agent API keys and password-reset tokens: SHA-256.
IAM-04 Are there role-based access controls? Yes. Owner / Admin / Viewer per organization.
IAM-05 Are administrative actions logged? Partially. Logins, MFA changes, API-key creation and revocation, product deletion and administrative changes are recorded in an audit log Owners and Admins can export. Not every data change is logged yet.

10. Infrastructure & Virtualization Security

# Question Answer
IVS-01 Where is the infrastructure hosted? Render.com, US-Oregon region, single region, no high-availability replica. No hosting outside the United States is offered.
IVS-02 Is the infrastructure SOC 2 / ISO 27001 attested? Render states it holds a SOC 2 Type II attestation. That covers Render's infrastructure, not LicensePulse.
IVS-03 Is there network segmentation? Partially. The public web service is the only application ingress. The managed database accepts no connections from the internet; the application reaches it over the hosting provider's private network.

11. Interoperability & Portability

# Question Answer
IPY-01 Can Customer export data in a standard format? Yes. CSV, and the original files for uploaded contracts.
IPY-02 Is there a documented API? No public API documentation. The interactive API documentation is disabled in production.

12. Mobile Security

# Question Answer
MOS-01 Is there a native mobile app? No. The web application is responsive and works on mobile browsers.

13. Security Incident Management, E-Discovery & Cloud Forensics

# Question Answer
SEF-01 Is there a documented incident response plan? In draft. Incidents are handled directly by the founders. A written incident-response procedure with roles and severity levels exists in draft and is awaiting founder approval.
SEF-02 What is the breach notification timeline? 72 hours from confirmed discovery.
SEF-03 Will you provide a post-mortem? Yes, within 14 days.
SEF-04 Will you support legal-hold / e-discovery requests? Yes, on lawful request and in accordance with the DPA.

14. Supply Chain Management, Transparency & Accountability

# Question Answer
STA-01 Do you maintain a list of sub-processors? Yes, at https://licensepulse.app/legal/subprocessors.html.
STA-02 Do sub-processors sign DPAs with you? Each sub-processor processes data under its standard data-processing terms.
STA-03 Do you give advance notice of new sub-processors? Yes, 14 days minimum.

15. Threat & Vulnerability Management

# Question Answer
TVM-01 Are there regular vulnerability scans? Dependencies only. CI scans Python and npm dependencies for known vulnerabilities on every pull request and every push to main, and scans the full Git history for committed secrets. We run no other automated vulnerability scans.
TVM-02 Are penetration tests performed? No penetration test has been performed, and none is scheduled. We are open to a customer testing a pilot environment under an agreed scope.
TVM-03 Is there a vulnerability disclosure program? Reports to security@licensepulse.app; we aim to respond within 5 business days.

Out-of-scope

The Service is not authorized for:

Customers must not upload such data. If you require any of the above, contact us before contracting.

Contact

Security questions: security@licensepulse.app General security correspondence: legal@licensepulse.app