Trust Centre

Security Questionnaire

Pre-answered responses to common security due diligence questions from pharmaceutical, biopharma, EPCM, and chemical manufacturing procurement teams.

Share security questionnaire

Accuracy notice: Answers marked “Partial” or “Roadmap” reflect our current state honestly. We do not claim capabilities we do not yet have. If you need a custom questionnaire response or additional evidence, please contact our enterprise team.

1. Data Encryption

Is data encrypted at rest?

Yes

Yes. All data stored in ChemCapital is encrypted at rest using AES-256 via AWS (Supabase / AWS eu-west-2). Encryption is managed at the database and storage layer.

Is data encrypted in transit?

Yes

Yes. All connections to ChemCapital use TLS 1.2 or higher. Unencrypted HTTP is redirected to HTTPS at the edge.

Are encryption keys managed separately from data?

Yes

Encryption key management is handled by AWS KMS via Supabase. Keys are not stored alongside application data.

2. Access Controls

Does the system enforce role-based access control (RBAC)?

Yes

Yes. ChemCapital enforces RBAC at the application level (OWNER, ADMIN, MEMBER, VIEWER roles). All data access is scoped by company identifier (companyId) at the database query level.

Is multi-factor authentication (MFA) available?

Yes

Yes. MFA is available for all user accounts. Enforcement options for enterprise tenants are available via admin settings.

Is single sign-on (SSO) supported?

Yes

Yes. SSO is available via SAML 2.0 and OIDC for enterprise tenants, powered by Supabase Auth. On sign-in, users enter their company domain and are redirected to your configured identity provider (IdP). Supported IdPs include Okta, Azure AD / Entra ID, Google Workspace, and any SAML 2.0-compliant IdP. Contact us to configure SSO for your domain.

Is privileged access managed and audited?

Yes

Administrative actions within ChemCapital are recorded in the audit log. Platform-level (infrastructure) privileged access is managed via AWS IAM and Supabase access controls.

3. Audit Logging

Does the system maintain an audit trail?

Yes

Yes. All data-change events are recorded in an audit log (AuditEvent) with user identity, timestamp (UTC), action type, and before/after values where applicable.

Are audit logs tamper-evident?

Yes

Yes. Every regulated write event records a SHA-256 payload digest and a chain digest (SHA-256 over payload + previous chain digest) using a PostgreSQL advisory lock to prevent concurrent writes breaking the chain. The audit viewer verifies chain integrity on every page load and flags broken links. All events display UTC timestamps per 21 CFR Part 11 and ALCOA+ requirements. Audit logs are exportable as JSON or CSV with a tamper-evident digest header.

Can audit logs be exported?

Yes

Yes. Audit log export is available as JSON (all events) or CSV (up to 5,000 events) via the Regulated Readiness → Audit Log page and the export API. Each export includes an X-Export-Digest header for verification. Date-range and action-type filtering are supported.

Are audit logs retained for the required period?

Yes

Yes. Configurable retention policies and legal hold are live under Enterprise Settings → Compliance. Retention periods default to 7 years for regulated records (aligned with GxP minimum). Records under legal hold cannot be deleted until the hold is explicitly released by an authorised administrator. A scheduled retention engine enforces automatic purging of records past their retention date.

4. Vulnerability Management

Is there a vulnerability management programme?

Partial

We apply dependency updates and security patches on an ongoing basis. A formal vulnerability management programme with scheduled scanning and remediation SLAs is on our Phase 1 roadmap.

Is penetration testing performed?

Roadmap

Annual penetration testing with a remediation report is on our 2026 roadmap. We have not yet completed a formal external penetration test.

Is there a responsible disclosure / bug bounty programme?

Partial

We accept responsible disclosure reports via security@chemcapital.com. A formal bug bounty programme is under consideration.

5. Backup and Recovery

Is data backed up regularly?

Yes

Yes. Supabase performs automated database backups with point-in-time recovery. Backups are stored in AWS eu-west-2.

What are the RTO and RPO targets?

Partial

We target a Recovery Time Objective (RTO) of 4 hours and Recovery Point Objective (RPO) of 1 hour for production data. These targets are based on our infrastructure architecture and have not yet been formally tested via disaster recovery exercises.

Are disaster recovery plans tested?

Roadmap

Formal DR testing exercises are on our 2026 roadmap. Current DR capability relies on Supabase automated backup and restore procedures.

6. Sub-processor and Supply Chain

Is there a sub-processor inventory?

Yes

Yes. Our sub-processor list is publicly available at chemcapital.com/trust#sub-processors. All sub-processors are bound by data processing agreements.

Are sub-processors reviewed before use?

Yes

Yes. Sub-processors are reviewed for security posture, DPA compliance, and regional data handling requirements before onboarding.

Is there a process to notify customers of sub-processor changes?

Yes

We maintain a change log for our sub-processor list. Enterprise customers can request advance notification of material sub-processor changes.

7. Incident Response

Is there a documented incident response procedure?

Yes

Yes. ChemCapital maintains an incident response procedure covering detection, triage, containment, investigation, notification, and remediation.

How quickly are customers notified of a breach?

Yes

We commit to notifying affected customers within 72 hours of confirming a personal data breach, in line with UK GDPR Article 33 and EU GDPR obligations.

Is there a 24/7 security incident contact?

Partial

Security incidents can be reported to security@chemcapital.com at any time. A 24/7 on-call security rotation is on our roadmap as we scale.

8. Personnel and Vetting

Are employees subject to background checks?

Yes

All employees and contractors with access to production systems are subject to background verification checks appropriate to their role.

Is security awareness training conducted?

Yes

Security awareness training is provided to all team members on onboarding and updated annually.

Need a custom response?

If your organisation uses a proprietary security questionnaire format (e.g. SIG Core, CAIQ, or internal vendor assessment), we can provide responses in your preferred format.

Request custom response →Back to Trust Centre