Security questionnaire
Your IT department's questionnaire, answered
The same questions arrive with every tender, so they are answered in advance and in writing. Where there is no answer we can stand behind, you will find the question and nothing underneath it: better a gap than a figure that cannot be defended two years later.
Last reviewed: 30 August 2026
This page is laid out for paper: print it or save it as a PDF from your browser and it comes out with no menus and no footer.
01Where the data is and who operates it
Where is the data hosted?
On our own servers located in the European Union, in a data centre in France operated by Hostinger International Limited. Backups stay within the same jurisdiction.
Are there any international data transfers?
No. Neither the hosting, nor the backups, nor support, nor administration work are provided from outside the European Economic Area, so there is no need to rely on standard contractual clauses or on the other Chapter V safeguards under the GDPR.
Is it a shared installation? How is each company's data kept apart?
It is shared. Every content table carries the company identifier and isolation is enforced in the data layer, not in the interface: a query cannot leave it out. There is also an automated test that puts a rival company into the same database, with content in every table, and checks from an employee's session that nothing of the other company can be reached. It runs with the rest of the suite, not once a year.
Can it be installed on our own servers?
Not today. The service is provided from our servers in the European Union.
02Encryption
Is traffic encrypted?
Yes. The site and the platform are served over HTTPS, and the session cookie is marked Secure and HttpOnly: it never travels over an unencrypted connection and JavaScript cannot read it. The pages load nothing from third parties — no fonts, no icons, no scripts — so opening one does not trigger a single outside request. Outgoing mail goes over TLS on port 465 or STARTTLS on port 587, depending on how the mailbox is configured.
What is stored in a form that would be useless to someone who walked off with a copy of the database?
Passwords are not stored: what is stored is a derivative obtained with scrypt and a different salt per user. Of the session identifier only its hash exists, so a dump of the table does not let anyone impersonate anyone. Same for the SCIM token: it is shown once when created and only its hash stays in the database. The SSO client secret does have to be readable again — it is sent to the identity provider on every code exchange — so it is encrypted with AES-256-GCM, with the key derived through HKDF under its own label.
Is the disk holding the database encrypted?
What is confirmed: the database is not exposed to the internet and is only reachable from the server itself. Uploaded files are stored on disk, in a folder per company, and are not reachable by direct address: every download re-checks the session and the company membership.
No written answer yet
Volume encryption is a measure of the machine, not of the application, so it is not asserted here. Ask us and we will confirm in writing what is configured on the server.
03Backups
Are backups taken, and where are they kept?
Yes. The terms of service provide for regular backups within the European Union, in the same jurisdiction as the data. They do not replace the exports the customer company can make on its own account, and they do not make the provider the keeper of the only copy.
How often are they taken, how long are they kept, and has a restore ever been tested?
Every night, scheduled on the server itself. The process does two things: a full dump of the database with pg_dump, in PostgreSQL's own compressed format, and a tar.gz of the uploaded files, from which the derived image copies are excluded because they regenerate on their own. They are kept for fourteen days, they rotate on their own, and they stay within the same jurisdiction as the data.
No written answer yet
The restore procedure and how long it takes are given in writing on request. That is the part that depends on the machine and on the volume of the day, and no number goes on this page that could not be held up in front of whoever checks it.
04Access control, roles and sessions
What roles are there and what can each one do?
Six: owner, administrator, people manager, IT administrator, editor and employee. Publishing without going through approval is available to the owner, the administrator and the editor. In the administration screens each one reaches only their own area: the people manager adds and removes people but sees neither billing nor single sign-on, and the IT administrator sets up SSO, API keys and the on-site screens but does not manage the workforce. And nobody can grant a role with more permissions than their own. The safeguards are checked on the server inside every action, not by hiding the button: a server action answers even if the button was never rendered.
How are accounts protected against brute force?
The account is locked for fifteen minutes after eight failed attempts, and the error message does not reveal whether that address exists. When there is no account to check, the hashing time is spent anyway, so the answer does not give away by its speed that the address is not registered.
How long does a session last?
Thirty days without use, in a window that slides every time someone signs in, with an absolute cap of one hundred and eighty days that does not slide: it forces everyone to identify themselves again at least twice a year. Expired sessions are deleted every night.
What closes a person's open sessions?
Changing their password, disabling the account from administration, and deprovisioning them from the HR system over SCIM. In all three cases every one of their sessions is deleted, so a tab left open stops working straight away.
Is there two-factor authentication?
Not our own. Anyone signing in with their company account through single sign-on goes through the conditional access rules and the second factor of their identity provider, and types no password here. For staff who sign in with an invitation code and a personal email address, that does not apply.
Can everyone be forced to sign in through the identity provider?
There is a setting that disables password sign-in for the configured email domains. It does not affect people who sign in with an access code and no company email: those accounts have no password to disable, and they are half the workforce in a factory or a warehouse.
05Single sign-on and provisioning
Which single sign-on is supported?
OpenID Connect, with Microsoft Entra ID, Google Workspace and Okta. It is set up by pasting the provider's discovery address, and the authorisation, token and key addresses come from there on their own. On our side the signature of the identity token is verified, along with the issuer being exactly the one that was asked for.
What about SAML 2.0 or LDAP?
No. Single sign-on goes over OpenID Connect and only over that. It is a decision, not a pending date: SAML is signed XML, verifying that signature properly requires XML canonicalisation, and that is where nearly every authentication bypass of the last decade has come from. If your tender requires SAML in writing, it is worth saying so before going any further.
Is there automatic user provisioning?
Yes, SCIM 2.0 at /scim/v2/Users. Exactly what is implemented is declared: filtering by userName and externalId, pagination and partial modification with PATCH. There are no bulk operations, no sorting, no etag and no password change over SCIM, and none of them are declared on purpose: declaring more than you do makes the sync skip people while believing it did not.
What happens when the HR system deprovisions someone?
The account is disabled, can no longer sign in, and its open sessions are closed. It is not deleted: deleting it would take their posts and comments with it, and a noticeboard full of holes is worse than a noticeboard with the name of someone who has left. There is a setting to anonymise instead of disable. A SCIM DELETE also disables.
How does your system authenticate against ours?
With a bearer token the company generates itself under Administration › Corporate identity. It is shown once and cannot be seen again: only its hash stays in the database. If it is lost, another one is generated and the previous one stops working.
06Audit log and activity
Is there an audit log?
Yes. Every entry records the company, who did it, the action, the entity affected, the IP address and the date. It covers people added and removed, role changes, invitations created and revoked, posts approved and rejected, documents uploaded and deleted, read receipts, password changes, the configuration and switching on of single sign-on and SCIM, and modules being enabled and disabled.
Does that log expire?
No. That is the difference from the day-to-day activity log, which does expire: the audit trail of sensitive actions stays.
Can it be consulted and exported?
Today it is consulted on request. There is still no screen that displays it and no export to a file.
What is recorded of each person's activity, and for how long?
Only if the company subscribes to the Access and activity module. In that case, the devices each person signs in from and the section visited are stored — /communities, not /communities/getafe-plant — and never the content of what is read or written. It is deleted automatically after ninety days. Each person sees their own devices in their profile, not just whoever administers: a control the workforce cannot look at is surveillance, and one they can is security.
07Sub-processors and what leaves the building
Who are the sub-processors?
Hostinger International Limited, as the provider of the infrastructure the servers are hosted on: it acts as a processor, has the corresponding agreement in place and does not access the content. And the external advisers providing accounting, tax and legal services, limited to billing data and bound by professional secrecy. Any change is communicated far enough in advance for the customer company to object.
Which third parties receive data as a result of using the tool?
No analytics, no advertising, no campaign management and no social media plugins. Fonts and every other asset are served from our own server. Two things and only two leave the building: email, through whichever sending server is configured; and browser notifications, if they are switched on, which pass through each person's browser push service signed with VAPID keys under RFC 8292.
Is any artificial intelligence model trained on our content?
No. Not on the posts, not on the comments, not on the survey answers and not on the documents. The tool has no artificial intelligence features, so it has nowhere to send your content in the first place.
08Retention, deletion and exit
How long is data kept?
For as long as the contract is in force. Within that there are deadlines applied automatically every night: activity is deleted after ninety days; read notifications after ninety; unread notifications after one hundred and eighty; contact form messages after a year; and expired sessions and invitations as soon as they expire. Server logs are kept for ninety days.
What happens when the contract ends?
The company has thirty calendar days of access in which to export its information. After that period, the data and the files are permanently erased within a maximum of thirty further days, backups included, with the sole exception of what has to be kept by law, which is limited to billing records.
How is the information taken out?
Documents and files are downloaded from the tool itself. A full dump of posts, people and answers is requested and delivered. There is no export everything button today: it is on the roadmap, with no committed date.
09Data protection and incidents
Who is the controller and who is the processor?
The customer company is the controller for its workforce's data; we are the processor. The processing agreement is published inside the privacy policy, with the Article 28 GDPR obligations set out one by one.
Is there a data protection officer?
None has been appointed, because none of the three cases in Article 37 of the GDPR applies: no public authority, no large-scale systematic monitoring and no large-scale special categories of data.
Can we audit you?
Yes. Among the obligations undertaken as processor is making available to the controller the information needed to demonstrate compliance and allowing audits, including inspections, with reasonable notice.
Who is notified if there is a personal data breach?
The customer company, which is the controller, without undue delay and with the information it needs to meet its own notification obligations towards the supervisory authority and, where applicable, towards the people affected. It is an obligation written into the processing agreement.
No written answer yet
The specific deadline in hours from detection is not committed in writing. If your tender requires a number, it is agreed in the contract before signing rather than assumed here.
Do you commit to an availability percentage?
No. The terms say the service is provided with reasonable diligence and that continuous availability is aimed for, but no guaranteed figure is committed, because it is neither measured nor compensated. If your tender requires a service level agreement with penalties, we do not meet it today.
Is a question from your tender missing?
Send it over and we will answer it in writing. The ones that keep coming back end up on this page, which is what it is for.
info@blastack.com