CAIQ Lite — Self-Assessment Responses
Apex Flow Technology Ltd (SwiftInvoicePro) · Version 1.2 · 18 August 2026 Responded by: Richard, Apex Flow Technology Ltd
Self-assessed. These responses are authored by the vendor and have not been reviewed, validated, or attested by a third party. They are provided in the spirit of the CSA CAIQ Lite format so that a procurement reviewer can compare us against a standard structure. Where the answer is "No", the reason is stated rather than deflected.
| # | Domain | Question (abbreviated) | Response | Note |
|---|---|---|---|---|
| A&A-01 | Audit & Assurance | Do you hold an independent audit report (SOC 2 / ISO 27001)? | No | Bootstrapped, pre-revenue. SOC 2 Type 1 planned at first paid enterprise deployment. See bridge letter. |
| A&A-02 | Audit & Assurance | Do you perform internal security reviews on a defined cadence? | Yes | Automated security_validation_report() after every migration touching public; results logged with operator and pass/fail. |
| A&A-03 | Audit & Assurance | Will you share audit artefacts with customers? | Yes | Whitepaper, architecture docs, validation run history, and these responses, under NDA. |
| AIS-01 | Application Security | Is input validated server-side? | Yes | Schema validation enforces types/UUIDs, strips angle brackets from free text, caps batch size. |
| AIS-02 | Application Security | Are errors normalised to prevent information disclosure? | Yes | Safe error codes only; no SQL text or stack frames returned to clients. |
| AIS-03 | Application Security | Has a third-party penetration test been performed? | No | Internal adversarial simulation only, published and labelled as such. External test will be scoped with the first enterprise agreement. |
| BCR-01 | Business Continuity | Are backups performed and encrypted? | Yes | Managed Postgres provider performs automated encrypted backups. |
| BCR-02 | Business Continuity | Is there a documented disaster recovery plan with tested RTO/RPO? | No | Recovery relies on provider point-in-time restore. Targets are not yet formally documented or tested. |
| CCC-01 | Change Control | Are schema changes governed by a written standard? | Yes | DATABASE-MIGRATION-STANDARD.md; new tables cannot pass validation without RLS policies and matching grants. |
| CCC-02 | Change Control | Is there separation between development and production data? | Yes | Separate environments; production data is not copied into development. |
| CEK-01 | Cryptography | Is data encrypted in transit? | Yes | TLS 1.3 for all application traffic. |
| CEK-02 | Cryptography | Is data encrypted at rest? | Yes | AES-256 at rest by the managed database provider. |
| CEK-03 | Cryptography | Are keys and secrets stored outside source control? | Yes | Server-side environment vault, read inside request handlers. No client-visible prefixes on secrets. |
| DCS-01 | Datacenter Security | Do you operate your own datacenters? | N/A | Fully hosted on Cloudflare and Supabase/AWS EU-West (Ireland). Physical security inherited from those providers. |
| DSP-01 | Data Security & Privacy | Is customer data logically segregated? | Yes | PostgreSQL Row Level Security is the isolation boundary; every tenant-scoped table carries organization_id or user_id. |
| DSP-02 | Data Security & Privacy | Is data minimisation applied? | Yes | Guest PII and transaction lines are processed in memory for the request lifetime and are not persisted. |
| DSP-03 | Data Security & Privacy | Are retention periods defined? | Yes | Published schedule; enquiries 12 months, pilot accounts 30 days post-pilot, tokenised card references 2–4 hours. |
| DSP-04 | Data Security & Privacy | Is a DPA available? | Yes | Art. 28 DPA available on request. |
| DSP-05 | Data Security & Privacy | Where is data stored? | EU | Single EU region (Ireland). No replication to a second continent. SCCs plus UK IDTA where a sub-processor processes outside the UK/EEA. |
| GRC-01 | Governance | Is there a written information security policy? | Partial | This document, the security whitepaper, and the architecture register serve as the policy set. A separately ratified ISMS is not in place. |
| GRC-02 | Governance | Is there a named security owner? | Yes | Richard, Apex Flow Technology Ltd — natromrich@googlemail.com. |
| HRS-01 | Human Resources | Are background checks performed on staff? | N/A | Single-operator engineering entity. No additional personnel with data access. |
| HRS-02 | Human Resources | Is security awareness training delivered? | N/A | As above. |
| IAM-01 | Identity & Access | Is access role-based and least-privilege? | Yes | Roles held only in user_roles, read via has_role; default public privileges revoked from anon/authenticated. |
| IAM-02 | Identity & Access | Can a client self-assign privileges? | No | organization_members is SELECT-only for authenticated users; writes are service-role. |
| IAM-03 | Identity & Access | Is MFA available for administrative access? | Partial | TOTP MFA is enforced on all infrastructure, repository, deployment, and communication accounts (whitepaper §5). Hardware security keys are not yet in use. In-product MFA for customer accounts is not offered today (no production tenants) and is committed for delivery before the first production pilot goes live, scoped in the pilot agreement. |
| IPY-01 | Interoperability | Can customers export their data? | Yes | CSV export in-product; full export on request. |
| IVS-01 | Infrastructure | Is the runtime stateless? | Yes | Per-request isolates; no long-lived server state between requests. |
| LOG-01 | Logging | Are security-relevant events logged? | Partial | Billing, invoice-usage, and webhook events written to audit_logs with actor, action, resource, IP, user agent. Append-only in practice; no client update/delete path. Authentication attempts and role changes are not yet covered. See whitepaper §4. |
| LOG-02 | Logging | Are logs scrubbed of personal data? | Yes | PII scrubbing applied before forwarding to any log sink. |
| SEF-01 | Incident Response | Is there an incident response contact and timeline? | Yes | natromrich@googlemail.com; acknowledgement within one business day; controller notified without undue delay and, where feasible, within 72 hours. |
| SEF-02 | Incident Response | Is there a bug bounty? | No | Good-faith disclosure welcomed; no paid programme. |
| SEF-03 | Incident Response | Is there a written incident response plan? | Yes | INCIDENT-RESPONSE-PLAN.md — severity tiers, named responder, containment and evidence steps, notification clock, post-incident review. Not yet exercised against a live incident. |
| STA-01 | Supply Chain | Is a sub-processor list maintained and published? | Yes | Cloudflare, Supabase (Lovable Cloud), Stripe, Resend — published with purpose and region. |
| STA-02 | Supply Chain | Do sub-processors hold their own certifications? | Yes | Cloudflare SOC 2 Type II / ISO 27001; Supabase/AWS SOC 2 / ISO 27001; Stripe PCI DSS Level 1. These cover the providers' platforms only and are not claimed by Apex Flow. |
| STA-03 | Supply Chain | Is a software bill of materials (SBOM) available? | Yes | A CycloneDX 1.5 SBOM is generated from the committed lockfile on every CI run and retained as a build artefact; supplied to reviewers on request, not published publicly. See whitepaper §4. |
| TVM-01 | Threat & Vulnerability | Are dependencies scanned? | Yes | CI job runs an automated CVE scan of the committed lockfile on every push and pull request, weekly on schedule, and on demand; the build fails on any high or critical finding, and each run retains a JSON report. The same job emits a CycloneDX SBOM of the resolved dependency tree, available on request. See whitepaper §4. |
| TVM-02 | Threat & Vulnerability | Is there a documented patch SLA? | Partial | Published operating targets — 48 hours critical, 30 days high/medium — documented in whitepaper §4. Not a contractual SLA; can be agreed commercially. |
| TVM-03 | Threat & Vulnerability | Is application source code scanned for security defects? | Yes | Continuous automated scanning (Aikido) across the codebase and infrastructure configuration — static application security testing, software composition analysis, secrets detection, and infrastructure-as-code and cloud posture checks. Automated analysis only; not a penetration test and not third-party attested. See whitepaper §4. |
| TVM-04 | Threat & Vulnerability | Are security controls tested against simulated attacks? | Partial | An adversary-simulation suite of 63 attacker-perspective tests runs in CI on every change, covering webhook forgery and replay, tenant-identifier manipulation, privilege escalation, open redirect, and credential exposure. All pass as of 18 August 2026. This is automated regression testing of application-layer gates, not an external penetration test. See whitepaper §4. |
| UEM-01 | Endpoint | Are endpoints with data access managed? | Partial | Single operator device with hardware-backed full-disk encryption, automatic screen lock, encrypted password manager, and non-production credentials for local work (whitepaper §5). No formal MDM and no container-sandboxed dev environment. |
Summary for reviewers
Strong: tenant isolation, least-privilege grants, secrets handling, data minimisation, EU residency, error handling, automated post-migration validation, continuous automated code and configuration scanning, adversary-simulation regression testing in CI.
Openly absent: third-party certification, external penetration test, tested DR targets, in-product MFA, formal patch SLA, MDM, hardware security keys, container-sandboxed local development. Each is a function of company stage, not of a decision to skip the control.
Ask for the bridge letter for the timeline and triggers attached to those gaps.