Enterprise procurement always sends a vendor security questionnaire. Use the answers below as a starting point — we keep them current and accept supplementary questions in writing.
Organisation
| Question | Answer |
| Legal entity | Codivion, LLC |
| Registered jurisdiction | United States (state on request) |
| Year founded | 2025 |
| Employee count | <10 (early-stage) |
| Primary contact for security | security@codivion.com |
| Cyber liability insurance | In progress (target Q2 2027) |
Architecture + hosting
| Question | Answer |
| Hosting provider | Vercel (compute), Supabase (data), Cloudflare (edge) |
| Primary region | us-east-1 |
| Multi-region replication | DB read replicas: roadmap. Active-active: not yet. |
| Tenant isolation | Postgres RLS on every tenant table |
| Network segmentation | Vercel-managed + Supabase VPC |
| Logical separation of customer data | Enforced at database level via Row Level Security policies |
Authentication + access
| Question | Answer |
| End-user auth | Email/password, OAuth (Google, GitHub), SAML 2.0 SSO (Team+), OIDC (Team+) |
| Session storage | HttpOnly Secure SameSite=Lax cookies |
| Session TTL | 30 days, refreshable |
| Internal admin auth | Platform admin allowlist in DB (RLS-enforced) |
| MFA support | Via SSO IdP |
| Password policy | NIST 800-63B aligned (length-first, no forced rotation) |
| Password storage | PBKDF2-SHA256 with per-user salt + 100k iterations |
| API key storage | SHA-256 hashed; never re-displayable after creation |
Encryption
| Question | Answer |
| In transit | TLS 1.2+, HTTP/2, HSTS preload |
| At rest (DB) | AES-256 (Supabase-managed) |
| At rest (object storage) | AES-256 (Supabase-managed) |
| Key management | Supabase-managed; BYOK on Enterprise roadmap |
| Customer data segregation key | Per-tenant cookie HMAC keyed by per-org password hash |
Compliance
| Question | Answer |
| SOC 2 Type I | In progress (target Q1 2027) |
| SOC 2 Type II | Planned Q3 2027 |
| ISO 27001 | Not pursued |
| HIPAA | BAA available on Enterprise with PHI use case |
| GDPR | DPA available — see DPA docs |
| CCPA | Compliant (no sale of personal data) |
| PCI DSS | Out of scope — Stripe handles all payment data |
Operational security
| Question | Answer |
| Incident response plan | Documented; CSM-led on Enterprise tier |
| Vulnerability disclosure | security@codivion.com, 48h ack, severity-based SLA |
| Penetration testing | Scheduled annually (next: 2026 Q4) |
| Security training for staff | Mandatory annual review |
| Background checks | Standard for all employees with prod access |
| Source code review | All commits reviewed via GitHub PR before merge |
Backups + recovery
| Question | Answer |
| Backup frequency | Daily snapshots, 30-day retention |
| Point-in-time recovery | 7 days |
| RTO | 4 hours |
| RPO | 1 hour |
| Backup encryption | AES-256 (Supabase-managed) |
| Backup access controls | Service-role only, audited |
| Disaster recovery test cadence | Annually |
Sub-processors
See DPA — current sub-processors. 14-day notice on new sub-processor additions; customer right to object.
Data subject rights
| Question | Answer |
| Access requests | Self-serve via dashboard + API export |
| Deletion requests | Self-serve project delete + admin-assisted full org delete on request |
| Data portability | Full DB export available on request (JSON dump) |
| Response SLA | 30 days max (GDPR-aligned) |
Logging + monitoring
| Question | Answer |
| Audit log retention | Team: 90d, Enterprise: unlimited (with export) |
| Security event log | Vercel + Supabase platform logs, 30 days |
| Alerting | Sentry (errors) + uptime monitoring + PagerDuty oncall |
| Customer-facing audit log | Yes — see Audit log docs |
Need something not on this list?
Email security@codivion.com with the specific question. We aim to respond within 5 business days.
