Trust centre

The answers a vendor security review asks for, published in advance

A vendor security review usually means a questionnaire, several weeks of email and a call. The questions are largely the same each time, so they are answered here in the detail a reviewer needs: architecture, access control, availability, recovery, incident handling, vulnerability management, how code reaches production, what happens to data over its whole life, and which frameworks we work to.

Two points about scope. Where a control is planned rather than running, the relevant page says so on the page itself rather than only in an appendix. And evidence — recovery test reports, access-control records, security policies, the completed questionnaire — is provided under NDA rather than published, because those documents describe operational detail in a form more useful to an attacker than to a reviewer.

Sixteen public pages

Security programme

Operations

Compliance and legal

Our security contact details are also published at /.well-known/security.txt in the format defined by RFC 9116.

Evidence, available within two business days

The pages above state what our controls are. The documents below evidence that they ran, and are provided to customers and to organisations in an active evaluation under a mutual NDA.

Request it from security@vaethra.com with the entity name and the NDA you would like signed, or ours.

Three terms, used consistently

Figures carry the date they were measured. Where a page states a number — tables with row-level security, functions executable by the public role, automated tests — it was taken from the running system on that date and can be re-checked on request.

If you find a statement here that does not match what you can observe, please tell us at security@vaethra.com.

The same documents as files, for the people who file things

A vendor record wants one attachment, not sixteen URLs. Counsel wants a contract that can be printed and signed. And a document read by a language model — now a normal step in a procurement review — is easier to supply as one file than as a crawl. All four carry the date they were issued and are rebuilt from the pages above, so a PDF cannot quietly diverge from what the site says.

Nothing here is under NDA. The evidence pack in §3 — policies, the risk register, recovery test reports, access-control evidence — is a separate request to security@vaethra.com.

Every address, and what it is for

Security contact details are also published at /.well-known/security.txt in the format defined by RFC 9116, so a scanner finds them without reading this page.

Legal entity and notice address

This is the entity that contracts, holds the infrastructure accounts and signs the Data Processing Agreement. It is established in the United States, so for a customer in the EEA or the UK it is the data importer under the Standard Contractual Clauses rather than the exporter.