EthicsPortal publishes pre-filled answers to the questions procurement teams most often ask. The questionnaire is organized by the Cloud Security Alliance’s CAIQ v4
domain taxonomy — the framework most EU enterprise procurement teams use — so an evaluator can place each answer in the domain their own assessment template expects. Where a CCM v4 control statement covers a question, the control is cited alongside it.
This is a vendor-authored answer set, not an attestation by the CSA. The substance is what an external auditor would evaluate; the structure makes it easy to compare against vendors who have been audited.
A downloadable CSV is published at caiq-ethicsportal.csvfor ingestion into procurement tools.
An EthicsPortal row identifier, stable across revisions. The code before the number is the CAIQ v4 domain; the number is our own sequence within that domain and is not a CCM v4 control number
Related CCM v4
The CCM v4 control whose published control statement covers this question, where one does. This is a cross-reference, not a control-level compliance claim: a row answers only the question stated, not the whole control. Blank where no v4 control statement directly covers the question. Some rows map to a control in a different domain, and more than one row may map to the same control
Question
EthicsPortal’s restatement of the question in the CAIQ domain
Answer
Yes, No, Partially, or N/A, with qualifiers where the substance is more useful than a binary — for example No (in treatment) when a control is on the operator’s roadmap, Yes (inherited) when a sub-processor’s certification carries the control, Yes (negative) when the affirmative answer to a “does the Service do X?” question is “no, by design”, or a specific value (24 hours, 99.5% monthly, Nuremberg) where one applies
Evidence
Link to the page or document that contains the substantive answer
Retired rows: EP-AIS-03 and EP-AIS-04 were withdrawn on 2026-10-06 as duplicates of EP-CEK-01 and EP-CEK-02, which answer encryption at rest and in transit. Row IDs are never reused.
Where a question’s answer is operationally sensitive (privileged-access mechanics, incident-response escalation contacts, infrastructure detail beyond what is on /security/
), the answer here is Available under NDA and is shared during procurement review. This mirrors the posture published on /trust/
.
When an independent audit or pen test is on record, scope, date, and remediation summary will be published on /trust/
EP-A&A-03
A&A-05
Does the organization conduct internal information security reviews?
Yes
Annual internal audit against ISO/IEC 27001:2022 with every finding published at Internal audit record
; outcomes reviewed and decided at Management review record
. The ISO 27001 self-assessment
is the audited artifact; security testing passes with findings and remediation are at Self-conducted security testing
. Self-performed — a single-operator organization cannot produce an impartial internal audit, and both pages say so
EP-A&A-04
Are compliance certifications listed publicly?
Yes
Certification status disclosed on /trust/
(none currently held; structured self-assessment in place)
Daily database dumps are encrypted with GnuPG AES-256 on the host before upload, and the monthly restore drill decrypts one and reads an encrypted column back. The 7-day server snapshots are not encrypted by EthicsPortal; application-encrypted fields remain encrypted in both (Security#backups-and-restore
)
EP-BCR-03
BCR-08
Are backup restores tested?
Yes
Monthly database restore into a scratch environment. The drill does not demonstrate end-to-end RTO; last date is on Security#backups-and-restore
Security#secure-development-lifecycle
— every change is checked against a written pre-deploy checklist, and the automated suite plus static analysis block the deploy on failure
EP-CCC-02
CCC-04
Is infrastructure managed as code?
Yes
Kamal deployment configuration version-controlled; no out-of-band production changes
EP-CCC-03
IVS-05
Are production and non-production environments separated?
Non-deterministic Rails ActiveRecord Encryption on defined report, identity and communication fields; daily database dumps encrypted with GnuPG AES-256 before upload; file attachments encrypted with AES-256 under a separate key per file. The server disk is not volume-encrypted, so database fields outside the encrypted set are stored unencrypted on the host (Security#data-encryption
)
Are customer-managed encryption keys (BYOK) supported?
No
Processor-managed keys support the current reporter–handler encryption design. Deletion follows the production and backup lifecycle stated in DPA §§6.8 and 6.11; no instantaneous deletion from every backup copy is claimed.
EP-CEK-04
IAM-15
Are passwords stored using a one-way hash?
Yes
Reporter passcodes bcrypt-hashed and non-recoverable; handler/admin authentication via magic-link plus TOTP, no plaintext password storage
EP-CEK-05
CEK-01
Is encryption key management documented?
Partial
Application field-encryption keys are processor-managed. Account-specific key storage, rotation and supplier access evidence requires procurement review (Security#data-encryption
)
Core application data, database, and file storage are in Germany. The public marketing site uses Cloudflare in a separate controller context disclosed in the Privacy Notice
; it is not part of the whistleblowing channel or the customer DPA processing chain.
After the Service ends, personal data is returned or deleted at the Controller’s choice; production deletion and backup expiry follow the documented lifecycle (DPA §6.8
)
EP-DSP-06
DSP-12
Is personal data minimization practiced?
Yes
Only essential fields are collected; reporter name and contact are optional. Art. 5(1)(c)
GDPR (Coverage map §7
)
EP-DSP-07
DSP-10, DSP-13
Is PII transmitted to any third party for processing?
Only to disclosed sub-processors
Subprocessors
lists every recipient with the data category. No LLM or AI service is a sub-processor (DPA §6.10
)
EthicsPortal has no employees or contractors. Personnel controls below are answered N/A with the compensating arrangements — privileged-access summary available during procurement review, operator self-directed security awareness via subscribed feeds — documented on /trust/
and in ISO 27001 control map A.6
.
ID
Related CCM v4
Question
Answer
Evidence
EP-HRS-01
HRS-01
Are background checks performed on personnel with access to customer data?
N/A
No employees. Operator screening is verifiable through published registry information (Trust#contracting-party
)
EP-HRS-02
HRS-11
Is security awareness training provided to personnel?
N/A
No employees. Operator self-directed via Rails security mailing list, CVE feeds, advisory subscriptions
EP-HRS-03
HRS-10
Are confidentiality agreements in place for personnel?
N/A
No employees. Customer-side confidentiality is in DPA §6.2
EP-HRS-04
HRS-05, IAM-07
Is there a documented offboarding procedure for personnel with system access?
N/A
No employees. Customer offboarding is governed by DPA §6.8
Multi-tenant at the application layer; isolation enforced by Pundit policies and per-organization scoping at every controller action (Security#access-control
)
EP-IVS-02
IVS-03, IVS-06
Is network segmentation in place?
Yes
Production isolated from operator workstation by network boundary; non-production environments hold no production personal data (Security#secure-development-lifecycle
)
EP-IVS-03
TVM-02
Is malware protection in place for uploaded content?
PostgreSQL triggers reject changes to core audit content and table truncation, and application users cannot edit or selectively delete individual entries. The trail is not hash-chained or WORM-backed, so privileged database intervention remains a documented residual risk (Risk register R-08
)
EP-LOG-03
LOG-02
How long are audit logs retained?
Customer-configurable
Matches case retention (12/24/36/48/60 months); included in PDF case exports for regulatory review
EP-LOG-04
LOG-03, LOG-05
Is application monitoring in place?
Yes
AppSignal instruments the application with session-data transmission disabled and request parameters filtered to preserve reporter anonymity (Subprocessors
)
The following operational topics are not in this public questionnaire because they contain infrastructure and response detail that is more appropriate for controlled disclosure. They are shared on request during procurement review:
CSA CAIQ v4 domain taxonomy (Audit & Assurance through Universal Endpoint Management); row IDs are EthicsPortal’s own, with CCM v4 controls cross-referenced per row where a control statement covers the question