# Predge Security Questionnaire (lightweight)

**Updated 20.10.2026:** answers E5 and J2 changed after the restore test (PASS, logical restore).

Status as of 20.10.2026. Structure follows a lightweight vendor questionnaire (SIG Lite / CAIQ-lite style). Answers are Yes, Partial or No. "Unverified" means the claim comes from founder notes or was not checked in code. Evidence links are given where they exist. Gaps reference the TRUST-PACK.md gap list.

## A. Governance

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| A1 | Is a named person accountable for security and compliance? | Yes | Amir Latypov, founder. TRUST-PACK.md section 0 | Sole person; no deputy |
| A2 | Are security policies written and approved with dates? | Partial | This pack, INCIDENT-RESPONSE.md, SLA.md (drafted 20.10.2026) | Not yet approved by counsel; no version history before 20.10 |
| A3 | Is there a formal risk register? | No | None | Create by 30.10.2026 (proposed) |
| A4 | Is there an approved security training program? | No | None | Solo operator; not planned |
| A5 | Is there a legal entity that can sign contracts? | No | Not incorporated | Delaware planned via Clerky. No date |

## B. Asset management

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| B1 | Is there an inventory of production systems? | Partial | Railway services and Vercel project (founder notes, repo configs) | No written inventory; write by 30.10.2026 (proposed) |
| B2 | Is there an inventory of third-party services that touch data? | Yes | TRUST-PACK.md section 3 | Verify Railway and Vercel regions (G21) |
| B3 | Are production secrets stored outside source control? | Partial | Env vars on Railway and Vercel. Secret scanning on whale-data-mcp only (03.10 audit) | Enable secret scanning on all repos; target 24.10.2026 (proposed) |

## C. Access control

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| C1 | Is MFA enforced on all admin accounts? | Unverified | Founder action item from 19.10 workshop | Confirm and enforce on GitHub, Railway, Vercel, Zoho, Name.com, npm, Circle by 24.10.2026 (G9) |
| C2 | Is access limited to least privilege? | Partial | Postgres: API role `x402_reader` has SELECT and INSERT, no UPDATE on verdicts, no DELETE. Owner DSN separate | Five services shared one owner role per 03.10 audit; current state unverified |
| C3 | Is access reviewed periodically? | No | None | Quarterly review from Q4 2026 |
| C4 | Are leaked or old credentials rotated? | Partial | GitHub PAT revoked 03.10. Telegram bot token and OpenAI key listed for rotation on 03.10 | Status unverified (G9) |
| C5 | Is there an audit log for production admin actions? | Partial | Railway and Vercel activity logs (platform) | No central log review |
| C6 | Are customer-facing accounts protected against credential stuffing? | Partial | Rate limiting on /api/* (120 per minute per IP, Redis). Signup Turnstile when secret set | Turnstile enabled state unverified |

## D. Cryptography and key management

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| D1 | Is there a documented signing key? | Yes | ed25519, kid 13fa3d18a369e6c7, https://api.predge.io/.well-known/predge-keys.json | None |
| D2 | Are signing keys stored in an HSM or KMS? | No | Env variable `ATTEST_SIGNING_KEY` on Railway | HSM or KMS, isolated signing service by 09.11.2026 (with v2) |
| D3 | Is there dual control or multi-person approval for signing? | No | Single operator | Not planned before incorporation |
| D4 | Can a compromised signing key be revoked and that status checked by verifiers? | No | Registry has no revocation field; `/verify` returns valid for any signature under the supplied key | Revocation status by 06.11.2026 (G5) |
| D5 | Is there key rotation with notice? | Partial | Rotation text in the registry says 30 days notice. Code emits only the current key, so prior keys are not kept listed | Implement with G5 by 06.11.2026 |
| D6 | Are customer webhook secrets protected at rest? | No | Stored as plaintext text in `desk_accounts.webhook_secret` (needed for HMAC) | Encrypt at rest by 13.11.2026 (G8) |
| D7 | Are API keys stored hashed? | Yes | pilot_keys stores SHA-256 hash only | None |
| D8 | Are signing operations logged or monitored? | No | None found | Count and alert on signatures per kid by 13.11.2026 (proposed) |
| D9 | Is the contract owner key on hardware or multisig? | No | Single EOA on a founder workstation (`~/.predge-deployer/deployer.json`, mode 0600) | Safe 2-of-3 by 09.11.2026 (G2) |

## E. Operations security

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| E1 | Is there endpoint protection and disk encryption on admin devices? | No | FileVault and firewall were off on 03.10 (audit) | Check and enable by 24.10.2026 (G9) |
| E2 | Are production changes made through reviewed PRs? | Partial | PRs used for the web app and API. Direct deploys via `vercel --prod` and Railway | Branch protection status unverified |
| E3 | Are production changes logged? | Partial | Git history, platform deploy logs | No change ticket system |
| E4 | Are dependencies monitored for vulnerabilities? | Unverified | Privacy page says so; no config found in repos | Enable Dependabot or equivalent by 24.10.2026 (proposed) |
| E5 | Are backups taken and tested? | Partial | Postgres daily (kept 6 days) and weekly (kept 27 days) backups since 03.10 (founder notes). Logical restore test of 29 business tables PASSED on 20.10.2026 (counts and checksums matched) | No Railway snapshot restore drill yet; off-site R2 backup failing since 27.04 (G1) |

## F. Network and infrastructure

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| F1 | Is transport encrypted (TLS)? | Yes | HTTPS for predge.io and api.predge.io (platform) | None |
| F2 | Is the API behind rate limits? | Yes | Web proxy: 120 per minute per IP on /api/*. API: per-route limits in code | None |
| F3 | Is the database reachable only from the application? | Partial | Public TCP proxy enabled for Redis and Postgres during 03.10 migration (founder notes) | Confirm private networking by 27.10.2026 (proposed) |

## G. Secure development

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| G1 | Are automated tests run? | Yes | vitest in predge-x402-api; round-trip signature test | Coverage not measured |
| G2 | Is there static analysis? | No | None configured in repos | Add before v2 (09.11.2026) |
| G3 | Has there been an independent security review? | Partial | Internal review 03.10 and self-review 20.10.2026 (`manual-review.md`) | No external review yet (G10) |
| G4 | Are known contract vulnerabilities disclosed? | Yes | Section 6 of TRUST-PACK.md lists H-01 to H-03 and M-01 | Full review ships with v2 |
| G5 | Is there a vulnerability disclosure channel? | No | hello@predge.io exists; no security.txt or policy | Publish security.txt and disclosure policy by 27.10.2026 (proposed) |

## H. Vendor management

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| H1 | Is there a sub-processor list? | Yes | TRUST-PACK.md section 3 | Verify items marked unverified |
| H2 | Are DPAs signed with sub-processors? | Unverified | Providers publish their own DPAs; none signed by Predge in its name | Confirm and record by 30.11.2026 (proposed) |
| H3 | Are vendors assessed for security before use? | No | None | Written check for new vendors from 30.10.2026 (proposed) |

## I. Incident response

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| I1 | Is there a written incident response plan? | Yes | INCIDENT-RESPONSE.md (20.10.2026) | Tabletop walk-through done (TABLETOP-2026-10-20); live drill by 15.01.2027 |
| I2 | Is there a status page? | No | Status section planned for predge.io/trust | 27.10.2026 (proposed) |
| I3 | Are customers notified of incidents within a set time? | Partial | SLA.md: P1 acknowledged within 4 hours (best effort) | Not yet tested |
| I4 | Is there a procedure for a compromised signing key? | Partial | INCIDENT-RESPONSE.md section 3 | Depends on revocation support (G5) |

## J. Business continuity and disaster recovery

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| J1 | Are RPO and RTO defined? | No | None | 27.10.2026 (G16) |
| J2 | Is there a tested restore? | Partial | Logical restore into an isolated PostgreSQL 18.6, PASS 20.10.2026, about 17 s end to end. `trades` and `wallet_score_history` restored schema-only | Not a Railway snapshot restore; no point-in-time recovery or WAL archiving (up to 24 h data loss); no date committed (G1) |
| J3 | Is there a DR site or secondary region? | No | Single Railway project, single instance, single region, no standby; backups are with the same provider | Not planned pre-incorporation |
| J4 | Can the signing key be recovered if lost? | No | No sealed offline copy documented | 27.10.2026 (G18) |

## K. Privacy and GDPR

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| K1 | Is there a privacy notice? | Yes | predge.io/privacy | Retention statements not yet enforced (G6) |
| K2 | Is there a lawful basis and data map? | Partial | This pack section 4 | Formal record of processing by 30.11.2026 (proposed) |
| K3 | Is personal data minimized? | Partial | Verdicts store hashes of delivery bodies, not bodies. Signup stores IP hash and email | IP hash is weak (G7, 13.11.2026) |
| K4 | Can data subjects request access and deletion? | Partial | Email to hello@predge.io, handled manually, 30 days | No self-serve tool |
| K5 | Are retention periods enforced? | No | No purge jobs in either repo | Purge jobs by 30.11.2026 (G6) |
| K6 | Is data residency stated? | Partial | Privacy page says US and EU | Verify regions (G21) |
| K7 | Are cross-border transfers covered? | Partial | Privacy page mentions Standard Contractual Clauses | No signed SCC set with sub-processors |
| K8 | Is there a DPO or equivalent? | No | Not required at current size; to confirm with counsel | Counsel review by 30.11.2026 (proposed) |
| K9 | Is a DPA offered to customers? | Partial | DPA-TEMPLATE.md drafted 20.10.2026 | Signable only after incorporation (G11) |

## L. Compliance and assurance

| # | Question | Answer | Evidence | Gap and target |
|---|---|---|---|---|
| L1 | SOC 2 Type I or II report? | No | None | Decision after pre-seed close (G13) |
| L2 | ISO 27001 certification? | No | None | Not planned for 2026 (G14) |
| L3 | External penetration test in the last 12 months? | No | Vaultline application pending | Outcome 02.11.2026; test by 15.01.2027 (G10) |
| L4 | Cyber or professional liability insurance? | No | None | After incorporation (G19) |
| L5 | Public audit of smart contracts? | No | Internal review and self-review only. External scan via Circle accelerator (Olympix) next | Before 09.11.2026 (G4) |