Support / SUP-840

Kelderby (prospect): security team's questions

Project: Support
Type: Question
Status: Done Done
Priority: Medium
Organization: Kelderby
Reporter: Henrik Lund <henrik.lund@kelderby.example>
Assignee: Tom Weber <tom.weber@acme-hq.example>
Labels: kelderbypre-salessecurity
Created: 13 May 2026, 14:00 UTC
Updated: 15 May 2026, 13:20 UTC
Resolved: 15 May 2026, 13:20 UTC

Description

Our security team asks:

Which cloud and which country?
Who are your sub-processors?
Is data encrypted at rest?
Do you have a yearly penetration test?

Comments (5)

Tom Weber · 14 May 2026, 07:30 UTCInternal note

Mira, can you check these before I send? Draft below.

AWS, Frankfurt (EU region), backups in the same region
Sub-processors: AWS, Mailcrest (email), Textbridge (SMS, from June)
AES-256 at rest, keys in AWS KMS
Yearly pen test by an outside firm

Mira Holm · 14 May 2026, 13:10 UTCInternal note

Correct. Point them to the sub-processor list on the trust page rather than listing them; it's the one we keep current. Last pen test report can go under NDA.

Tom Weber · 15 May 2026, 08:20 UTC

Hi Henrik, answers from our security lead:

Cloud and country: AWS, in our EU region in Frankfurt. Backups are in the same region.
Sub-processors: listed on our trust page, which we keep current and change only with 30 days' notice.
Encryption at rest: yes, AES-256, keys held in AWS KMS.
Penetration test: yes, once a year by an outside firm. We can share the last report under NDA.

Henrik Lund · 15 May 2026, 13:05 UTC

Good, that is what they need. NDA comes from our legal team.

Tom Weber · 15 May 2026, 13:20 UTC

Thanks. Closing.