Security Questionnaire
Our standing answers, published rather than sent on request.
Last updated August 30, 2026
This is LazySEM's standing answer to a vendor security questionnaire, published rather than sent on request. It follows the shape of a CAIQ Lite or SIG Lite and is organised by the domains those use.
We publish it because most of a security review is spent establishing facts that do not change between reviewers. If your questionnaire asks something not covered here, email info@lazysem.com and we will answer it and add it to this page.
Two things to know before you read it.
Every "no" below is a real no. We do not hold a security certification, we have never had an independent penetration test, and several controls a mature vendor would have are on a roadmap rather than in place. Those answers are here in the same table as the good ones.
Nothing here is aspirational. Every "yes" describes something running in production today. Where an answer states a limit, the limit is the current behaviour, not a caveat added for safety.
Related: the Trust Center at /trust explains the same ground in prose, and the binding commitments are in the Terms at /terms, the Privacy Policy at /privacy-policy and the Data Processing Addendum at /dpa.
Governance, risk and compliance
| # | Question | Answer |
|---|---|---|
| GRC-01 | Do you hold ISO 27001 certification? | No. Not held, not in progress, no audit scheduled. |
| GRC-02 | Do you hold a SOC 2 Type I or Type II report? | No. Not held, not in progress, no audit scheduled. |
| GRC-03 | Do you hold PCI-DSS certification? | Not applicable. Card data is handled entirely by Stripe and never reaches LazySEM systems. Stripe is PCI-DSS Level 1 certified. |
| GRC-04 | Is there a named person accountable for security? | Yes. The founder. LazySEM is a small company and does not have a separate security function. |
| GRC-05 | Do you have a written information security policy? | Partially. Individual controls and procedures are documented, including a personal data breach procedure. A single consolidated ISMS-style policy document does not exist. |
| GRC-06 | Do you maintain Records of Processing Activities under GDPR Article 30? | Yes. Sixteen processing activities recorded with all nine Article 30(1) elements. Available to customers on request under section 14 of the DPA. |
| GRC-07 | Have you carried out a Data Protection Impact Assessment? | Yes, for the processing that warranted one: our use of public forum and user-generated content in briefing workflows. A screening assessment concluded a DPIA is not required for the platform generally. |
| GRC-08 | Have you appointed a Data Protection Officer? | No, and one is not required. A documented Article 37 assessment concluded that LazySEM does not meet the appointment criteria. |
| GRC-09 | Who is the contracting entity? | Got Reach s.r.o., registered in the Czech Republic. Company number (ICO) 23712082, VAT CZ23712082, registered office Zlochova 2405/8, Modrany, 143 00 Praha. |
| GRC-10 | Which supervisory authority has jurisdiction? | The Czech Office for Personal Data Protection. Got Reach s.r.o. is EU-established, so no Article 27 representative is required. |
Audit and assurance
| # | Question | Answer |
|---|---|---|
| AUD-01 | Do you conduct independent penetration testing? | No. No third-party penetration test has ever been performed. This is an open gap and it is on our roadmap. |
| AUD-02 | Do you conduct internal security reviews? | Yes. Internal reviews are performed, including a multi-tenant isolation audit. These are not a substitute for an independent test and we do not present them as one. |
| AUD-03 | Will you complete our security questionnaire? | Yes. Section 14 of the DPA commits us to it on reasonable written request. |
| AUD-04 | Will you allow an on-site or remote audit? | We will contribute to audits and provide the information reasonably necessary to demonstrate compliance, once per year or after a breach notification. We do not grant direct access to production systems, because that would expose other customers' data. |
| AUD-05 | Do you operate a vulnerability disclosure programme? | Yes. Published at /trust with a safe-harbour statement, and machine-readable at /.well-known/security.txt per RFC 9116. We acknowledge reports within five business days. |
| AUD-06 | Do you operate a paid bug bounty? | No. Reports are reviewed and fixed on their merits, and reporters are credited if they wish. |
Data security and privacy
| # | Question | Answer |
|---|---|---|
| DSP-01 | Where is customer data stored? | In the European Union. Application services, the PostgreSQL database and the cache run in Railway's EU West region. |
| DSP-02 | Is data encrypted in transit? | Yes. HTTPS with TLS on all public traffic, HTTP redirected to HTTPS, HSTS set on lazysem.com and app.lazysem.com. |
| DSP-03 | Is data encrypted at rest? | Yes, by our managed infrastructure providers. LazySEM does not operate its own key management system and does not hold its own database encryption keys. |
| DSP-04 | Is any data encrypted at the application layer? | Yes. Connected integration tokens, such as Google OAuth tokens, are encrypted by LazySEM before they are written to the database, above the provider's encryption. |
| DSP-05 | How are passwords stored? | Hashed with bcrypt using a per-password salt. The plaintext is never stored. |
| DSP-06 | Do you support customer-managed encryption keys? | No. |
| DSP-07 | Is customer data segregated between tenants? | Yes. Each organisation is a separate tenant and authorisation is enforced server-side per request. |
| DSP-08 | Do you have a documented data retention schedule? | Yes, defined per data category so data is not held indefinitely by default. |
| DSP-09 | Can a customer export their data? | Yes. CSV export of workflow data, a CSV export of the organisation activity log, and a self-service account data export. For a complete export across every service, email info@lazysem.com and we will assemble it. |
| DSP-10 | Can a customer delete their data? | Yes. A user can delete their own account from Settings, then Security. The account locks immediately and the data is removed after a 30-day grace period, during which the request can still be cancelled by contacting us. Data can also be deleted on request at any time. |
| DSP-10a | What happens if the person deleting is the only owner of a shared organisation? | The request is refused and names the organisation, so that other members are not stranded without anyone able to manage billing or membership. Ownership must be transferred first. |
| DSP-11 | What happens to data at the end of the contract? | At the customer's choice we return it in a commonly used machine-readable format or delete it. If no choice is expressed within 30 days of termination, we delete it. Records we must keep for legal, tax or accounting reasons remain protected by the DPA for as long as we hold them. |
| DSP-12 | Do you use customer data to train AI models? | No. Customer content is processed to produce the outputs the customer asked for. It is not used to train models, and section 6 of the Terms limits our licence to operating the service. |
| DSP-13 | Do you sell or share customer data? | No. |
Identity and access management
| # | Question | Answer |
|---|---|---|
| IAM-01 | Do you support multi-factor authentication? | Yes. TOTP from any standard authenticator app, with ten single-use backup codes. Backup codes are stored as hashes, so they cannot be re-displayed after enrolment. |
| IAM-02 | Can MFA be enforced organisation-wide? | No. MFA is per-user and opt-in today. Administrator-enforced MFA is on the roadmap. |
| IAM-02a | What happens if a user loses their authenticator? | They sign in with one of the ten single-use backup codes issued at enrolment. If those are lost too, an owner or admin of their organisation can reset their MFA from the Team Members page, and the user then enrols again. The reset is recorded in the organisation's audit log. |
| IAM-02b | Can an administrator bypass a user's MFA? | No. An administrator can clear a member's enrolment, which the member sees the next time they sign in and which is written to the organisation's audit log. There is no mechanism for an administrator to read a member's secret or backup codes, or to authenticate as them. |
| IAM-02c | Can a user disable their own MFA without presenting a factor? | No. Disabling it requires both the account password and a current authenticator or backup code. The administrator reset above deliberately refuses self-service use, so that a stolen session cannot be used to switch the second factor off. |
| IAM-02d | Are administrator MFA resets restricted by role? | Yes. Only an owner may reset an owner's MFA; an administrator cannot. The target must also be a member of the administrator's own organisation. |
| IAM-03 | Do you support SAML or enterprise single sign-on? | No. There is no SAML, no OIDC-as-identity-provider and no SCIM provisioning. Google sign-in is supported, which is social login rather than enterprise SSO. |
| IAM-04 | Do you support role-based access control? | Yes. Four roles per organisation: owner, admin, member and viewer. Permissions are enforced server-side on every administrative action. |
| IAM-05 | Can a role held in the browser grant access the server has not authorised? | No. Authorisation is evaluated server-side per request. |
| IAM-06 | Is there an audit log of user and administrator activity? | Yes. Each organisation has an activity log covering authentication events, administrative actions and membership changes. Administrators can view it in the product and export it as CSV. |
| IAM-07 | How is internal access to production controlled? | Access to production infrastructure and customer data is restricted to authorised operators who need it to operate, maintain or support the service. |
| IAM-08 | Can sessions be revoked immediately? | Yes. Access tokens can be revoked server-side through a token denylist, so logout or revocation takes effect immediately rather than at token expiry. |
| IAM-09 | Do you support IP allowlisting? | No. |
| IAM-10 | Do you support API access, and how is it authenticated? | Yes. Personal access tokens, scoped and organisation-bound, and a Model Context Protocol endpoint for connecting external AI clients. |
Application security
| # | Question | Answer |
|---|---|---|
| AIS-01 | Which security headers do you set? | X-Frame-Options DENY, X-Content-Type-Options nosniff and a strict-origin-when-cross-origin referrer policy on application and API responses. HSTS on lazysem.com and app.lazysem.com. A Content Security Policy on app.lazysem.com. |
| AIS-02 | Do you protect against cross-site request forgery? | Yes, using the double-submit cookie pattern. |
| AIS-03 | Do you rate-limit authentication and API endpoints? | Yes, backed by a shared cache so limits hold across service instances. |
| AIS-04 | Do you validate and bound request sizes? | Yes. |
| AIS-05 | Are internal service calls authenticated? | Yes. Service-to-service calls are authenticated rather than trusted by network position. |
| AIS-06 | Do you run automated tests before deploying? | Yes. Continuous integration runs type checking, linting and the test suites on every push. |
| AIS-07 | Do you use static or dynamic application security testing tooling? | Not as a dedicated security scanning pipeline. This is a gap. |
| AIS-08 | Do you maintain a staging environment separate from production? | Not currently. This is a gap and it is on our roadmap. |
Infrastructure and operational resilience
| # | Question | Answer |
|---|---|---|
| BCR-01 | Do you publish an uptime SLA? | No. Services currently run as single instances, so deploys and restarts cause brief interruptions. We would rather publish no commitment than one the architecture cannot honour. Multi-instance deployment comes before any uptime commitment. |
| BCR-02 | Do you have a public status page? | No. This is a gap. Service disruptions are communicated by email to affected customers. |
| BCR-03 | Are databases backed up? | Yes. Automated backups by our managed database provider, inheriting that provider's encryption. |
| BCR-04 | Have you tested restoring from backup? | Not with a formal timed drill. We therefore do not publish a recovery time or recovery point objective. Completing that drill is on our roadmap. |
| BCR-05 | Do you have a documented disaster recovery plan? | Partially. Restore is a documented operational task; a full DR plan with tested objectives is not in place. |
| BCR-06 | Is infrastructure deployed across multiple availability zones or regions? | No. Single region, EU West. |
Incident management
| # | Question | Answer |
|---|---|---|
| SEF-01 | Do you have an incident response process? | Yes for personal data breaches, which follow a documented procedure with a breach register. A separate runbook for availability incidents is a gap. |
| SEF-02 | What is your breach notification timeline? | Without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting a customer's data. This is contractual, in section 11 of the DPA, not best-effort. |
| SEF-03 | Will you notify us before completing your investigation? | Yes. An initial notification is sent on becoming aware and updated as more is established. Notification is not held back pending investigation. |
| SEF-04 | What will the notification contain? | To the extent known: the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, and the measures taken or proposed. |
| SEF-05 | Will you assist with our own regulatory obligations? | Yes, under GDPR Articles 33 and 34. |
| SEF-06 | Do you maintain a breach register? | Yes, including reasoning for incidents assessed as not notifiable under Article 33(5). |
Third parties and supply chain
| # | Question | Answer |
|---|---|---|
| STA-01 | Do you publish a subprocessor list? | Yes, at /subprocessors, naming each provider, the service it performs and its legal entity and country. |
| STA-02 | Will you notify us before adding a subprocessor? | Yes. At least 30 days' advance notice by email to the account's administrative contact, with a right to object on reasonable data protection grounds under section 7 of the DPA. |
| STA-03 | What safeguards cover transfers outside the EEA? | An adequacy decision of the European Commission, or the European Commission's Standard Contractual Clauses (Decision 2021/914) as incorporated into that provider's data processing agreement. For UK customers, the UK International Data Transfer Addendum applies. Copies available on request. |
| STA-04 | Do you have signed data processing agreements with all subprocessors? | Not all. Collecting the outstanding agreements is in progress. We would rather state that than imply a complete set. |
| STA-05 | Is a DPA available to customers? | Yes, at /dpa. It is binding through section 13 of the Terms and requires no separate signature. We will execute a counterpart on request. |
People
| # | Question | Answer |
|---|---|---|
| HRS-01 | How many people have access to production? | LazySEM is operated by a very small team. Production access is limited to those who need it to run the service. |
| HRS-02 | Are background checks performed? | No formal background check programme exists at current size. |
| HRS-03 | Is security awareness training provided? | No formal training programme exists at current size. |
| HRS-04 | Are staff bound by confidentiality obligations? | Yes. Section 10 of the DPA commits LazySEM to ensuring that personnel authorised to process customer personal data are bound by confidentiality. |
What we would tell a reviewer to focus on
If you are deciding whether the residual risk is acceptable, the three answers that matter most are AUD-01 (no independent penetration test), GRC-01 and GRC-02 (no certification), and BCR-01 (no uptime commitment, single-instance deployment). Those are the substantive gaps. The rest of this page describes controls that are in place.
If any of those is a hard requirement for your process, tell us at info@lazysem.com. It changes how we prioritise, and we would rather know than be quietly declined.
Contact
Security, questionnaire and evidence requests: info@lazysem.com. Privacy and data protection matters, including data subject requests: the same address.
For the same ground in prose, see the Trust Center. For the binding commitments, see the Data Processing Addendum and the Terms of Service.