EthicsPortal publishes pre-filled answers to the questions procurement teams most often ask. The questionnaire is organized by the Cloud Security Alliance’s CAIQ v4
domain taxonomy — the framework most EU enterprise procurement teams use — so an evaluator can place each answer in the domain their own assessment template expects.
This is a vendor-authored answer set, not an attestation by the CSA. The substance is what an external auditor would evaluate; the structure makes it easy to compare against vendors who have been audited.
A downloadable CSV is published at caiq-ethicsportal.csvfor ingestion into procurement tools.
An EthicsPortal row identifier. The code before the number is the CAIQ v4 domain; the number is our own sequence within that domain and is not a CCM v4 control number. A CCM v4 control ID such as A&A-02 names a specific control in the CSA matrix and does not correspond to the row numbered EP-A&A-02 here
Question
EthicsPortal’s restatement of the question in the CAIQ domain
Answer
Yes, No, Partially, or N/A, with qualifiers where the substance is more useful than a binary — for example No (in treatment) when a control is on the operator’s roadmap, Yes (inherited) when a sub-processor’s certification carries the control, Yes (negative) when the affirmative answer to a “does the Service do X?” question is “no, by design”, or a specific value (24 hours, 99.5% monthly, Nuremberg) where one applies
Evidence
Link to the page or document that contains the substantive answer
Where a question’s answer is operationally sensitive (privileged-access mechanics, incident-response escalation contacts, infrastructure detail beyond what is on /security/
), the answer here is Available under NDA and is shared during procurement review. This mirrors the posture published on /trust/
.
When an independent audit or pen test is on record, scope, date, and remediation summary will be published on /trust/
EP-A&A-03
Does the organization conduct internal information security reviews?
Yes
Annual internal audit against ISO/IEC 27001:2022 with every finding published at Internal audit record
; outcomes reviewed and decided at Management review record
. The ISO 27001 self-assessment
is the audited artifact; security testing passes with findings and remediation are at Self-conducted security testing
. Self-performed — a single-operator organization cannot produce an impartial internal audit, and both pages say so
EP-A&A-04
Are compliance certifications listed publicly?
Yes
Certification status disclosed on /trust/
(none currently held; structured self-assessment in place)
Is input validation enforced on all external inputs?
Yes
Rails framework defaults (strong parameters, output escaping); application-level checks at every controller boundary (Security#secure-development-lifecycle
)
EP-AIS-03
Is encryption applied to sensitive data at rest?
Partial
Non-deterministic application encryption covers defined report, identity and communication fields; attachment and whole-backup encryption is not verified (Security#data-encryption
)
Application-encrypted fields remain encrypted in the dump; whole-dump encryption is not verified, and Hetzner Object Storage does not encrypt by default (Security#backups-and-restore
)
EP-BCR-03
Are backup restores tested?
Yes
Monthly database restore into a scratch environment. The drill does not demonstrate end-to-end RTO; last date is on Security#backups-and-restore
Security#secure-development-lifecycle
— every change is checked against a written pre-deploy checklist, and the automated suite plus static analysis block the deploy on failure
EP-CCC-02
Is infrastructure managed as code?
Yes
Kamal deployment configuration version-controlled; no out-of-band production changes
EP-CCC-03
Are production and non-production environments separated?
Non-deterministic Rails ActiveRecord Encryption on defined database fields; attachments and whole backups are not verified as encrypted (Security#data-encryption
)
EP-CEK-02
Is data in transit encrypted?
Yes
HTTPS/TLS; HTTP redirected
EP-CEK-03
Are customer-managed encryption keys (BYOK) supported?
No
Processor-managed keys support the current reporter–handler encryption design. Deletion follows the production and backup lifecycle stated in DPA §§6.8 and 6.11; no instantaneous deletion from every backup copy is claimed.
EP-CEK-04
Are passwords stored using a one-way hash?
Yes
Reporter passcodes bcrypt-hashed and non-recoverable; handler/admin authentication via magic-link plus TOTP, no plaintext password storage
EP-CEK-05
Is encryption key management documented?
Partial
Application field-encryption keys are processor-managed. Account-specific key storage, rotation and supplier access evidence requires procurement review (Security#data-encryption
)
Core application data, database, and file storage are in Germany. The public marketing site uses Cloudflare in a separate controller context disclosed in the Privacy Notice
; it is not part of the whistleblowing channel or the customer DPA processing chain.
After the Service ends, personal data is returned or deleted at the Controller’s choice; production deletion and backup expiry follow the documented lifecycle (DPA §6.8
)
EP-DSP-06
Is personal data minimization practiced?
Yes
Only essential fields are collected; reporter name and contact are optional. Art. 5(1)(c)
GDPR (Coverage map §7
)
EP-DSP-07
Is PII transmitted to any third party for processing?
Only to disclosed sub-processors
Subprocessors
lists every recipient with the data category. No LLM or AI service is a sub-processor (DPA §6.10
)
EthicsPortal has no employees or contractors. Personnel controls below are answered N/A with the compensating arrangements — privileged-access summary available during procurement review, operator self-directed security awareness via subscribed feeds — documented on /trust/
and in ISO 27001 control map A.6
.
ID
Question
Answer
Evidence
EP-HRS-01
Are background checks performed on personnel with access to customer data?
N/A
No employees. Operator screening is verifiable through published registry information (Trust#contracting-party
)
EP-HRS-02
Is security awareness training provided to personnel?
N/A
No employees. Operator self-directed via Rails security mailing list, CVE feeds, advisory subscriptions
EP-HRS-03
Are confidentiality agreements in place for personnel?
N/A
No employees. Customer-side confidentiality is in DPA §6.2
EP-HRS-04
Is there a documented offboarding procedure for personnel with system access?
N/A
No employees. Customer offboarding is governed by DPA §6.8
Multi-tenant at the application layer; isolation enforced by Pundit policies and per-organization scoping at every controller action (Security#access-control
)
EP-IVS-02
Is network segmentation in place?
Yes
Production isolated from operator workstation by network boundary; non-production environments hold no production personal data (Security#secure-development-lifecycle
)
EP-IVS-03
Is malware protection in place for uploaded content?
PostgreSQL triggers reject changes to core audit content and table truncation, and application users cannot edit or selectively delete individual entries. The trail is not hash-chained or WORM-backed, so privileged database intervention remains a documented residual risk (Risk register R-08
)
EP-LOG-03
How long are audit logs retained?
Customer-configurable
Matches case retention (12/24/36/48/60 months); included in PDF case exports for regulatory review
EP-LOG-04
Is application monitoring in place?
Yes
AppSignal instruments the application with session-data transmission disabled and request parameters filtered to preserve reporter anonymity (Subprocessors
)
The following operational topics are not in this public questionnaire because they contain infrastructure and response detail that is more appropriate for controlled disclosure. They are shared on request during procurement review: