Baobyte AML Suite
Book a demo

CISO

Answers to the questionnaire, including the uncomfortable ones

You are running a vendor risk assessment on a system that will hold identity documents, transaction histories and investigation narratives for your entire customer base. What decides it is not a security narrative — it is where each control is enforced, what has actually been tested, and whether the vendor tells you which controls are not finished.

  • Row-level tenant isolation
  • OIDC federation with your IdP
  • Scoped machine identities
  • Published control status

What you are measured on

What a CISO carries after this decision

Whether the vendor survives your security review without exceptions
Every exception you grant to onboard a supplier is one you own afterwards. What decides it is specificity: where controls are enforced, what is tested, and whether the vendor's answers change under follow-up questions.
Blast radius if a credential is compromised
Not whether a breach is possible but how far it reaches. A machine credential that can read customer content and a machine credential scoped to ingest are different incidents entirely.
Whether tenant isolation is enforced or merely intended
Application-layer filtering is one missing WHERE clause from a cross-tenant disclosure. Enforcement at the data layer changes the failure mode from silent leakage to a refused query.
Whether joiner, mover and leaver actually works
Identity federated to your IdP means a leaver disabled centrally is a leaver everywhere. Local accounts that persist after an IdP deactivation are the standard finding in a vendor review.
Whether an incident is containable and reportable
Evidence preserved, the affected population identifiable, notification obligations met on time. Under the Nigerian data protection regime that last part is not discretionary.
Whether the vendor's own staff can see customer data
The question suppliers answer least well. Routine operational access to tenant content should not exist, and support access should be an approved, time-bound, recorded session rather than a standing privilege.

Security review

The questionnaire, answered

Third column is the evidence required before the control is accepted — which is also the list worth asking us to produce during your review.

Security review questions, the control, and the evidence required to accept it
AreaHow it is enforcedEvidence required
Tenant isolationTenant context is resolved before request handlers run, and tenant tables carry a tenant identifier with row-level security forced at the databaseLive isolation test, migration lint, and an evidenced denied cross-tenant query
AuthenticationDelegated to your configured OIDC provider; the platform performs authorisation rather than holding passwordsFederation test, multi-factor and recovery test, and a route permission audit
Machine identityService accounts are opaque and digest-only, scoped to machine permissions, revocable, and cannot read customer, case or report contentOne-time reveal, rotation and revocation tests, and a misuse test
Sensitive data at restCustomer, identifier and document data encrypted or blind-indexed by design, with per-party keysCrypto test vectors, a key rotation report and a sensitive-access audit sample
Evidence storageObject evidence is write-once ciphertext with explicit storage health checksAccess test, no-delete test and a restore sample
Database privilegeRuntime, migration and platform privileges are separated rather than sharing one superuserRole grants, migration review and a production connection test
Deployment safetyProduction startup refuses unsafe defaults, missing secrets and unsigned content packsPreflight checks, negative startup tests and a change record
Vendor accessA platform operator has no routine access to tenant content; support access requires an approved, time-bound sessionSupport-session approval records and a negative test that browsing without one fails

Status

What is not finished

Platform

Which capabilities a security review examines

Security architecture

Deployment options, data residency, the tenancy model and the identity architecture — the page your review will spend the most time on.

Learn more

Audit and privacy

Sensitive-access review, retention, legal holds and the append-only audit chain your incident investigation would rely on.

Learn more

Integrations

Machine identities that are separate from human ones, scoped to ingest permissions, and revocable without touching a user account.

Learn more

Customer and CDD

Where the sensitive data actually lives: per-party field encryption and blind indexing, so identifiers are searchable without being exposed.

Learn more

Implementation

The deployment path, including the production preflight that refuses unsafe defaults, missing secrets and unsigned content.

Learn more

Governed reporting

Where data leaves the boundary — report generation, export permissions and the filing channel — which is usually the part a data-flow review needs mapped.

Learn more

Evidence

What we can hand your review team

  • The permission model as a route-level registry, testable by attempting prohibited actions and evidencing the refusals.
  • Negative-access test results recording route, actor, tenant, expected status and the audit evidence produced.
  • Service-account lifecycle: issue, one-time reveal, rotation, revocation and every permission ever held.
  • Sensitive-read events and denied attempts, sampled independently by your audit function.
  • The append-only per-tenant audit chain and its verification output, for use in an incident investigation.
  • Subprocessor and provider position, with contracts, data-use terms, timeout and retry policy and failure evidence.

Proof

Certifications and attestations

The block most likely to be filled with logos that mean less than they appear to.

Placeholder — no certification or third-party attestation has been achieved or approved for publication. Replace with sourced, approved content before this page is made public.

Certification position — not yet publishable

Standard, scope, certifying body, certificate identifier and validity dates belong here, alongside anything genuinely in progress with a target date. A badge implying a certification that is not held is the fastest way to fail the review this page exists to support.

—

Information security certification

Awaiting scope, body and certificate identifier.

—

Service organisation report

Awaiting report type, period and auditing firm.

—

Data protection registration

Awaiting the current registration position and its date.

Questions

What security reviews ask first

Where is tenant isolation enforced?
At the data layer. Tenant context resolves before handlers execute and tenant tables carry a tenant identifier with row-level security forced, so a query that omits the boundary is refused rather than silently returning another tenant's rows. Application-layer filtering alone is one missing predicate away from a disclosure, which is why it is not the primary control here.
Can your operations staff read our data?
Not in normal operation. A platform operator's grant covers tenant lifecycle, infrastructure, backup, restore and operational support — not routine customer content. Support access to content requires an approved session that is time-bound and recorded, and the negative case (browsing tenant data without one) is covered by the release test suite rather than by a policy statement.
What can a compromised ingest credential reach?
Transaction and batch submission, and ingest outcomes. Service accounts are opaque and digest-only, cannot assume a human role, and hold no content-read permission — so the incident is a data-quality and availability problem rather than a customer data disclosure. Rotation and revocation are immediate and do not disturb human accounts.
What is the honest state of your security controls?
Mixed, and published as such. Identity, tenancy, encryption, service accounts, maker-checker and the audit chain are implemented and under test. Backup, restore and key escrow against agreed recovery targets are pending an operational drill; incident response is pending an exercise; production database privilege separation is pending live verification; signed content packs are pending a production release key; and external provider controls depend on contracts and a data protection impact assessment. A vendor presenting a uniformly green security posture before your environment has tested anything is presenting a design document.
How does this sit under the Nigerian data protection regime?
As a processor of personal data with the obligations that follow: lawful basis for the processing, defined retention rather than indefinite storage, minimisation in what is exported, subject-rights handling that does not break the audit record, and a documented subprocessor position. The specifics for your institution belong in your own data protection impact assessment and agreement, not in a vendor page.

Related reading

Start the conversation

Send the questionnaire

We would rather answer your standard vendor assessment in writing, including the rows where the answer is 'not yet, and here is the owner and the target date', than talk you through a security architecture diagram.

Send us your security questionnaireRead the security overview