Trust centre

The answers a vendor security review asks for, published in advance

A vendor security review usually means a questionnaire, several weeks of email and a call. The questions are largely the same each time, so they are answered here in the detail a reviewer needs: architecture, access control, availability, recovery, incident handling, vulnerability management, how code reaches production, what happens to data over its whole life, and which frameworks we work to. It is written before the first enterprise agreement on purpose: so that the first enterprise conversation is not stalled for a quarter by a questionnaire, and so that a reviewer can see what is running and what is committed before anyone is asked to trust a summary.

Two points about scope. Where a control is planned rather than running, or committed rather than yet exercised, the relevant page says so on the page itself rather than only in an appendix. And evidence — the risk register, the records of processing, access reviews, vendor assessments, the policy set, and the recovery test report once the first exercise has run — is provided under NDA rather than published, because those documents describe operational detail in a form more useful to an attacker than to a reviewer.

eighteen public pages

Security programme

Operations

Compliance and legal

Our security contact details are also published at /.well-known/security.txt in the format defined by RFC 9116.

Evidence, available within two business days

The pages above state what our controls are. The documents below evidence that they ran, and are provided to customers and to organisations in an active evaluation under a mutual NDA. Each row says whether the document exists today or depends on an exercise that has not yet been run, because a document offered by name and not yet written is exactly the failure this page is written against.

Request it from security@vaethra.com with the entity name and the NDA you would like signed, or ours.

Three terms, used consistently

Figures carry the date they were measured. Where a page states a number — tables with row-level security, functions executable by the public role, automated tests — it was taken from the running system on that date and can be re-checked on request.

If you find a statement here that does not match what you can observe, please tell us at security@vaethra.com.

The same documents as files, for the people who file things

A vendor record wants one attachment, not eighteen URLs. Counsel wants a contract that can be printed and signed. And a document read by a language model — now a normal step in a procurement review — is easier to supply as one file than as a crawl. All four carry the date they were issued and are rebuilt from the pages above, so a PDF cannot quietly diverge from what the site says.

Nothing here is under NDA. The evidence pack in §3 — policies, the risk register, recovery test reports, access-control evidence — is a separate request to security@vaethra.com.

Every address, and what it is for

Security contact details are also published at /.well-known/security.txt in the format defined by RFC 9116, so a scanner finds them without reading this page.

Legal entity and notice address

This is the entity that contracts, holds the infrastructure accounts and signs the Data Processing Agreement. It is established in the United States, so for a customer in the EEA or the UK it is the data importer under the Standard Contractual Clauses rather than the exporter.