Security questionnaires: standard answers

Owner: Tom Weber · Signs off new answers: Mira Holm

The answers we give in customers' security questionnaires, each with where it comes from. In Emargen, start a topic with the Security questionnaire template (or the Security questionnaire flow); the agent checks each answer against the code and these pages. If a question isn't here, ask Mira before answering.

Last full check: Halden Foods' 40 questions, 9 October to 13 October (ACM-268).

Sign-in and access

Question	Answer	Source
Single sign-on with Entra ID?	Yes, over SAML, switched on site by site. Okta too.	Single sign-on
MFA for all users?	Through Entra ID or Okta, the customer's own MFA covers every sign-in. Administrators who use a password must use an authenticator app.	MFA policy
Accounts created and removed automatically from Entra ID?	Not today. Administrators import people from a spreadsheet.	Accounts from Entra ID (provisioning)
Can site managers approve their own people's access?	Yes, since October 2026.	Roles and approvals
Role-based access?	Yes. Every permission comes from a role the customer's administrators assign.	Roles and approvals
Audit log?	Yes: who, what and when, for access and settings. Kept 400 days (about 13 months) for every customer.	Approvals audit log
Audit log to our SIEM?	As a daily export file; there is no live stream.	Approvals audit log
Brute-force protection?	Accounts lock after repeated failed sign-ins; limits per address at the edge.	Sign-in lockout and rate limits

Data

Question	Answer	Source
Where is our data?	In the region set when you are onboarded: EU (Frankfurt), UK (London) or US (Virginia), backups included.	Data regions
Encryption at rest?	Yes, AES-256 for databases, files and backups.	Encryption and keys
Who manages the keys?	ACME, in the cloud provider's key service, rotated yearly.	Encryption and keys
Backups, and are restores tested?	Nightly, kept 35 days; a restore is tested each quarter. Last test 25 September.	Backups
Recovery objectives?	Recovery point 24 hours, recovery time 8 hours.	Backups
Deleted when the contract ends?	Yes, 30 days after the end; backups age out within 35 days after that. You can export everything first.	Data export for leaving customers
Sub-processors?	Listed on our trust page, with 30 days' notice of changes.	Sub-processors
Where are notices sent from?	EU customers: our mail provider's EU account since 16 October.	Data regions

Operations and people

Question	Answer	Source
Incident response plan?	Yes, reviewed yearly and rehearsed twice a year.	Incident response
Breach notification?	Within 48 hours of confirming a breach that affects you; our DPA commits to 72.	Incident response
Vulnerability scanning?	Weekly, and on every change for dependencies.	Vulnerability management
Last penetration test?	5 October to 9 October 2026, by an outside firm. No critical or high findings; summary under NDA.	Penetration test 2026
Who at ACME can see our data?	A named few in support, through a logged and approved request. Support works from inside the EU.	Support access to customer data
DDoS protection?	Yes, at the edge, with a web application firewall.	Vulnerability management
Monitored around the clock?	Yes; alerts page the on-call engineer at any hour.	Engineering's On-call
ISO 27001?	Certified since 2024; certificate under NDA.	ISO 27001 notes

Don't promise

These come up often. Say what exists, and that product has the ask.

• Automatic provisioning from Entra ID or Okta (being shaped, no date).
• Twelve months of sign-in log for auditors; idle sign-out on shared PCs (being shaped, no date).
• Limiting administrators to known IP addresses (not available).
• Hardware keys for administrators (an idea).

Change history

Version	Date	Who	What
1	4 Mar 2024	Tom	First list
18	14 Aug 2026	Tom	Audit log; data export
19	11 Sep 2026	Tom	Lockout
21	13 Oct 2026	Tom	Halden's 40 questions: notices from the EU, support from the EU, don't promise
22	23 Oct 2026	Tom	Penetration test report received