Our security answers, before you ask.

Not in place yet, stated plainly.

21 answers below are a no, a not yet or a partly. Each one names the control we rely on instead and the plan, where one is published.

• GOV-03 Do you have a SOC 2 report? Not yet
• GOV-04 Do you hold ISO 27001 or another security certification? No
• GOV-05 Do you perform a formal risk assessment? Not yet
• GOV-06 How do you manage third-party and vendor risk? Partly
• IAM-02 Do you support single sign-on (SAML or OIDC)? Not yet
• IAM-03 Can we require multi-factor authentication for our users? Not yet
• ENC-04 Can we bring or manage our own encryption keys? No
• HOST-02 Can data be stored outside the United States? No
• BCP-02 How are backups taken? Partly
• BCP-03 Do you test restoring from backup? Not yet
• BCP-05 Do you publish measured uptime? Partly
• SDLC-03 Is every change reviewed by a second person before it ships? Partly
• VULN-01 Have you had an independent penetration test? Not yet
• VULN-02 Do you scan for vulnerabilities? Partly
• VULN-05 Do you run a bug bounty? Not yet
• LOG-02 Can we see or export our workspace audit log? Partly
• LOG-04 Do you run a SIEM or a 24/7 security operations center? No
• PRIV-04 Do you support GDPR or UK GDPR processing? Not yet
• HR-02 Do you run background checks? No
• HR-03 Do you provide security awareness training and an acceptable use policy? Partly
• PHYS-02 How are administrative devices secured? Partly

Governance and compliance.

GOV-01 Do you have a documented information security policy?

Yes A written set of eleven security policies was adopted on 2026-09-28: information security, access control, change management, incident response, risk assessment, vendor management, data retention and disposal, business continuity and backup, acceptable use, security awareness, and vulnerability management. The set is reviewed every January and whenever the stack changes in a way that affects a control. Source: Security policy set v1.0 (available under NDA, DPA §12) · DPA §12

GOV-02 Who is accountable for information security?

Yes The founder, Lauren Cline, is the named Security Officer and owns every security policy. Security reports go to security@thesweetnote.com. Source: Security policy set v1.0 (available under NDA, DPA §12) · Security page, Vulnerability disclosure

GOV-03 Do you have a SOC 2 report?

Not yet No SOC 2 report has been issued yet. A Type 1 is planned once an independent auditor is engaged, and a Type 2 within 12 months of it. Until then, the controls are documented in the DPA and in the written policy set, both reviewable before you sign. If a Type 2 is a hard requirement for you, email us before you commit and we agree the timing in writing. Source: Security page · DPA §12

GOV-04 Do you hold ISO 27001 or another security certification?

No SweetNote holds no ISO 27001 or other security certification today. Source: Security page

GOV-05 Do you perform a formal risk assessment?

Not yet Not yet as a dated annual document. The adopted policy requires a written risk assessment every January (assets, threats, controls, remaining risk, owner and next step) and an extra one whenever a new vendor, kind of data or method is added. The first annual assessment has not been completed; it is due before a SOC 2 auditor is engaged. Source: Security policy set v1.0 (available under NDA, DPA §12)

GOV-06 How do you manage third-party and vendor risk?

Partly Policy requires a current security attestation (SOC 2 or equivalent), signed data-processing terms and multi-factor authentication before a vendor touches customer or recipient data. Every subprocessor is listed publicly and bound by written terms no less protective than the DPA, and SweetNote remains liable for them. Vendor SOC 2 reports are being collected; the first annual vendor review is not yet recorded. Source: DPA §8 · Subprocessor list §1 · Security policy set v1.0 (available under NDA, DPA §12)

GOV-07 Can we audit you?

Yes Most audit requests are met with questionnaire answers like these and our security documentation under NDA. If that is not enough, you may inspect on site on 30 days' written notice, once per calendar year, at your expense; if the audit finds a material non-compliance attributable to SweetNote, we reimburse your reasonable audit costs and fix it within 30 days. Source: DPA §12

Access control and authentication.

IAM-01 How do customer users sign in?

Yes By an emailed sign-in link, or with Google or Microsoft. There is no password sign-in, so SweetNote stores no customer passwords. Source: Security page · Procurement bundle, Security overview

IAM-02 Do you support single sign-on (SAML or OIDC)?

Not yet SSO is planned after launch for every customer, with no enterprise tier and no upcharge. If you need it now, email support@thesweetnote.com. Source: Security page · Procurement bundle, Security overview

IAM-03 Can we require multi-factor authentication for our users?

Not yet Not yet as a SweetNote setting; customer MFA is on the roadmap at no extra charge. Users who sign in with Google or Microsoft are subject to whatever MFA your organization enforces on those accounts. Source: Security page · Procurement bundle, Security overview

IAM-04 Is multi-factor authentication required for SweetNote's own administrative access?

Yes Yes. Policy requires MFA for all administrative access and on every vendor console that can reach production or money. The internal operator console requires a multi-factor session, enforced in the database, not only in the browser. MFA on each vendor console is confirmed in the quarterly access review, the first of which is not yet recorded. Source: DPA §7 · Security policy set v1.0 (available under NDA, DPA §12)

IAM-05 Do you offer role-based access for our team?

Yes A workspace has four roles: Owner (one, transferable), Admin, Analyst (read-only) and Developer (integrations and API keys, no member management). Source: Portal, Settings, Team (signed-in customers)

IAM-06 How is our data separated from other customers' data?

Yes In the database. Postgres row-level security restricts every query on a customer table to the caller's own workspace, and tables holding recipient data deny all access to customer and anonymous roles; only SweetNote's server functions read them, each scoped to one workspace in code. Server functions work out the workspace themselves and never accept one from the caller, so isolation holds even if another customer's login is compromised. Source: DPA §7 · Security page, Isolation

IAM-07 Which SweetNote staff can access our data?

Yes Production access is limited to the founder, on least privilege. The operator tools read aggregate data only: no internal screen, the founder's included, shows a per-recipient reaction, engagement timing or any name-attached engagement signal. SweetNote staff access recipient names and addresses only through the logged path used to fulfil deletion and access requests. Source: MSA §12.2 · Privacy notice §9.1 · Security page, Isolation

IAM-08 Do you review access rights periodically?

Yes Yes, quarterly. The access-control policy requires a review that lists every account with access to each system, confirms MFA is on and removes anything unused, with the result recorded. The first review was recorded in October 2026 (every console read, unused tokens deleted, MFA turned on where it was off); the next is due in January 2027. Source: Security policy set v1.0 (available under NDA, DPA §12)

IAM-09 How are secrets and credentials managed?

Yes Server keys live only in server-side environments and on the encrypted administration laptop, never in a browser or the code repository. Credentials are kept in a password manager and never shared. Secrets are rotated when someone who held them loses access, when exposure is suspected, and at the vendor's expiry. Source: Security policy set v1.0 (available under NDA, DPA §12)

Encryption.

ENC-01 Is data encrypted in transit?

Yes TLS 1.2 or higher on every page, dashboard and API call, with older protocols off at the edge. Every page also sends HTTP Strict Transport Security for one year, including subdomains, alongside a Content Security Policy and anti-framing and anti-sniffing headers. Source: DPA §7 · Security page · HTTP response headers on every page

ENC-02 Is data encrypted at rest?

Yes AES-256 (or equivalent) for all Personal Data in databases, object storage and backups, with provider-managed keys. Source: DPA §7 · Security page

ENC-03 Is recipient personal data given extra protection?

Yes Recipient names, addresses, email addresses and other personal fields you upload are also encrypted field by field with an AES-256 envelope, so observability tools and database snapshots do not expose them in plain text. Source: DPA §13.1 · Security page

ENC-04 Can we bring or manage our own encryption keys?

No Customer-managed keys are not offered. Key-management procedures are available under NDA. Source: Security page

ENC-05 How is video content protected?

Yes Video is served only through short-lived signed playback URLs (typically 5 minutes). There are no public video URLs to scrape, and an expired URL returns HTTP 403. Source: DPA §7

Hosting and subprocessors.

HOST-01 Where is the service hosted?

Yes In the United States. Supabase runs the database, sign-in, file storage and server functions in US-East; Netlify serves the site and pages from its CDN; Mux hosts video. SweetNote runs no servers of its own. Source: Security page · Subprocessor list §1 · DPA §9

HOST-02 Can data be stored outside the United States?

No SweetNote serves US customers and US-resident recipients only, and does not transfer Personal Data outside the United States in the ordinary course. Non-US recipient data must not be uploaded. UK, EU and Canada support is on the roadmap and will come with the transfer safeguards each requires. Source: DPA §9 · Security page

HOST-03 Who are your subprocessors?

Yes Supabase (database, sign-in, storage, server functions), Netlify (hosting, CDN), Mux (video), Postmark (transactional email to your team), Stripe (payments), Sentry (error monitoring) and Better Uptime (status page and uptime monitoring). Google Fonts and jsDelivr serve static files to browsers and are disclosed on the list. Source: Subprocessor list §1 · Security page, Subprocessors

HOST-04 How are subprocessors bound?

Yes Each has a written data-processing agreement with obligations no less protective than the SweetNote DPA, and SweetNote remains liable to you for their breaches of those obligations. Source: DPA §8 · Subprocessor list §1

HOST-05 Will we be told about a new subprocessor?

Yes At least 30 days' written notice before a new subprocessor starts processing your data. You may object on reasonable data-protection grounds; if it cannot be resolved, you may end the affected studies with a pro-rated refund of unused prepaid fees. Source: DPA §8

HOST-06 Do your pages load third-party analytics, advertising or tracking scripts?

No The site, the recipient page and the dashboard load no analytics vendor, advertising pixel or tracking tag. Error monitoring (Sentry) is not loaded on the recipient page. Source: Subprocessor list §2 · Security page, Subprocessors

Data handling and minimization.

DATA-01 What personal data do you process?

Yes Only what you choose to upload. No field is required: a first name personalizes the greeting, and addresses are used only to build the print file we return to you. Count-only studies process no recipient names or addresses at all. We also record pseudonymous engagement events keyed to an opaque token, never a name, and three coarse labels from the first scan (device type, OS family, US state or country). If you turn on CRM sync for a study, we also hold the CRM record ID you supply for each recipient, encrypted, and delete it with the name. Source: DPA §4 · Security page, What we record

DATA-02 What data do you deliberately not collect?

Yes Biometrics (no camera, microphone, face or voice), device fingerprints, cross-site or behavioral tracking, the IP address or user agent alongside a scan, free text from recipients, and card or account details. Source: Security page, What we record · DPA §14.1

DATA-03 What do your dashboards and reports show?

Yes Aggregates only. SweetNote's dashboards, reports and benchmark never show a named recipient's engagement. On your dashboard counts show; a rate, percentage or interval is withheld when its base is under 25 recipients, and small groups of scan labels are folded or withheld. Source: Security page, Isolation · DPA §4

DATA-04 Is there any per-recipient data path?

Yes Four, each switched on per study by you. The opt-in recipient-level export returns your own engagement data as a pseudonymous, token-keyed file with no names, under its own DPA schedule. CRM sync, when you connect your Salesforce or HubSpot account and turn it on for a study, writes the study's facts (sent, scanned, booked, a first-scan timing band and the version) onto the CRM records you identify, under the same schedule; it never writes the reaction or viewing detail and never creates a person record. Integrations you switch on forward pseudonymous, token-keyed events to your own systems. And a study pre-registered for publication can release a token-keyed research export with no names. None is a SweetNote analytics surface. Source: DPA Recipient-Level Export Schedule · DPA §10 · Security page, What we record

DATA-05 Is our data used for anyone else?

Partly Only as de-identified aggregates. Floor-aggregated data may be used for statistical benchmark computation and methodology research, never for AI training. The cross-brand benchmark is not active yet; when it is, it uses aggregate cells only, through a restricted database role, with minimum brand and recipient counts per cell, and is empty below them. Source: Security page, Isolation · DPA §4, Cross-tenant benchmark · DPA §4

DATA-06 Can we send regulated or sensitive data?

No SweetNote is not a HIPAA business associate and is not designed to hold GLBA financial data or FERPA education records, and special categories of personal data should not be uploaded. Source: DPA §4, Regulated data · DPA §4

DATA-07 What happens to data uploaded before a study is paid?

Yes It is encrypted like live data, used only to show your draft, and never used for analytics or benchmarks. You can delete it at any time; recipient data on a draft that never becomes a paid study is deleted automatically 90 days after upload, after three reminder emails. Source: DPA §13.1

DATA-08 Does SweetNote contact our recipients?

No SweetNote never emails recipients and does not print or mail. You handle fulfillment; we return the QR codes and, if you supplied addresses, a print-ready merge file. Source: Subprocessor list §1 · DPA §4

DATA-09 Is anything stored on a recipient's device?

Partly On the hosted video page, one first-party cookie records the recipient's consent choice. When the code opens your own site, nothing is stored on the device. Source: Privacy notice §5 · Security page, Your own site

Retention and deletion.

RET-01 How long are recipient names and addresses kept?

Yes They are deleted automatically 30 days after the engagement window closes (about day 60 after activation), together with the scan labels and delivery dates. That removes the only link between an engagement event and a person. Source: DPA §13 · Security page, Retention

RET-02 How long are engagement events kept?

Yes Events are captured for 90 days from activation, keyed by a pseudonymous token, and the readout settles on the first 30 days. De-identified events and aggregate counts are deleted on a rolling 24-month basis. Source: DPA §13 · Security page, Retention

RET-03 What else has a retention window?

Yes Customer video: 5 years from upload, or shorter if you ask in writing before the study activates. Consent records: 5 years. The Outcome Attribution cell map: a 120-day hard ceiling. Server logs: up to 45 days (hosting and database logs 7 days or less). The settled study report stays while your workspace is open, and is deleted if you ask. One schedule applies to every customer; the only per-study election is that shorter video window. Audit logs are kept for at least 7 years. Source: DPA §13

RET-04 Is deletion automatic?

Yes Each window is enforced by scheduled database jobs rather than by hand, and a failed retention job raises an alert to the operator. A legal hold pauses deletion only for the held data. Source: DPA §13 · Security policy set v1.0 (available under NDA, DPA §12)

RET-05 What happens to our data when the contract ends?

Yes At your option we return it in a commonly used format or delete it and instruct subprocessors to do the same. If you do not choose within 30 days, it is deleted on the standard schedule. Source: DPA §13

RET-06 How fast are deletion requests handled?

Yes Within 10 business days, passed on to every subprocessor that received the data, and recorded in the audit log. Source: Security page, Retention · DPA §10

RET-07 How long do backups keep deleted data?

Yes Database backups are taken daily and kept for 7 days, so a deletion reaches the backups within that rotation. Source: DPA §13.1

Incident response and breach notice.

IR-01 Do you have a documented incident response plan?

Yes Yes. A written runbook with pre-written customer notice templates. Policy requires a quarterly review of the runbook and a log entry for every suspected incident, including reports that turn out to be nothing; the first quarterly review is not yet logged. Source: Security page · Incident log and runbook (available under NDA, DPA §12)

IR-02 How quickly will you notify us of a breach?

Yes Without undue delay, and in any event within 72 hours of becoming aware of a Security Incident affecting your Personal Data. The notice covers the nature of the incident, the categories and approximate numbers affected, the likely consequences, the measures taken and a point of contact, with updates as the investigation proceeds. Source: DPA §11 · Security page

IR-03 Will you provide a post-incident report?

Yes A root-cause analysis and a written post-incident report go to every affected customer. Source: Security page

IR-04 Will you notify regulators or individuals on our behalf?

No Not without your prior written approval, unless the law requires SweetNote itself to give that notice; in that case we tell you first where the law allows. Source: DPA §11

IR-05 Have you had a security breach?

No SweetNote has recorded no Security Incident affecting customer Personal Data. Source: Incident log and runbook (available under NDA, DPA §12)

IR-06 How are availability incidents communicated?

Yes On the public status page at status.thesweetnote.com. We aim to post within 15 minutes of detection and to update at least every 30 minutes until resolved. You can subscribe by email or RSS. Source: MSA Exhibit A

IR-07 Do you indemnify us for a security incident?

Yes SweetNote defends you against third-party and regulator claims arising from a Security Incident affecting Personal Data in the custody of SweetNote or its subprocessors, subject to the data-protection cap in the MSA. Source: MSA §10.1

Business continuity, backups and uptime.

BCP-01 Do you have a business continuity plan, and what are your recovery objectives?

Yes Yes. A written business continuity and disaster recovery plan, adopted 2026-07-06, covers provider redundancy, loss scenarios, key-person succession and communications. Its targets: recovery time under 1 hour for the site and recipient pages (redeployable from source control to any static host) and under 24 hours for the application backend; recovery point 24 hours or less for customer and platform data. The targets have not yet been tested by a restore drill. Source: Business continuity plan (available under NDA, DPA §12)

BCP-02 How are backups taken?

Partly The managed database provider takes automated daily backups and keeps the last 7; backups are encrypted at rest. Point-in-time recovery is not enabled today. The database schema can be rebuilt from versioned migrations in source control. Source: Business continuity plan (available under NDA, DPA §12) · DPA §13.1 · DPA §7

BCP-03 Do you test restoring from backup?

Not yet Not yet. The continuity plan requires a full restore drill into a separate project, with row counts checked, before the first paying customer and once a year after that. The first drill has not been logged yet. Source: Business continuity plan (available under NDA, DPA §12) · Security policy set v1.0 (available under NDA, DPA §12)

BCP-04 What uptime do you commit to?

Yes A contractual 99.0% Monthly Uptime Percentage for the recipient pages and your dashboard, with service credits of 10%, 25% or 50% of that month's active study fees, and a right to terminate after three consecutive months below 95.0% or any single month below 90.0%. Source: MSA Exhibit A

BCP-05 Do you publish measured uptime?

Partly The status page at status.thesweetnote.com shows availability and incident history. A measured monthly uptime figure is not published yet. Source: MSA Exhibit A

Secure development and change management.

SDLC-01 Do you follow a secure development practice?

Yes The service is built against the OWASP Top 10, tenant isolation is enforced in the database, and server keys never reach a browser. That is our own review, not an independent one. Source: Security page · DPA §7

SDLC-02 How are changes controlled?

Yes Every change to the main branch goes through a pull request with automated checks. Database changes are versioned migrations, applied only from a clean copy of the main branch, and the full test suite runs on it before every production deploy session. Source: Security policy set v1.0 (available under NDA, DPA §12)

SDLC-03 Is every change reviewed by a second person before it ships?

Partly Not by a second person. Changes built with AI coding assistance get an independent review before merge; the founder's own changes and some low-risk changes merged by the assistant get none, and branch protection is not available on our current code-hosting plan. The compensating control is a monthly sign-off of every change that reached the main branch, starting with the first monthly change log, which is not yet recorded. Source: Security policy set v1.0 (available under NDA, DPA §12)

SDLC-04 Is production data used in development or testing?

No Automated tests run on fixtures and disposable databases. Production data stays in production, apart from what a single operator task needs. Source: Security policy set v1.0 (available under NDA, DPA §12)

SDLC-05 How are emergency changes handled?

Yes Through the same pull-request path, with the review completed within one business day afterward and noted in the monthly change log. Source: Security policy set v1.0 (available under NDA, DPA §12)

Vulnerability management and penetration testing.

VULN-01 Have you had an independent penetration test?

Not yet An annual third-party penetration test is planned, starting the quarter after early customer studies launch, with the report shared under NDA. Today the service is built against the OWASP Top 10; that is our own review, not an independent one. Source: Security page · DPA §7

VULN-02 Do you scan for vulnerabilities?

Partly Third-party dependencies, yes: a monthly check, first run on 2026-09-27 (clean), tests each package the platform ships (browser scripts, server-function imports, bundled libraries) against the public OSV vulnerability database; unpinned references fail the check, and any reachable advisory is logged and the package upgraded. No third-party application scanner (static or dynamic) runs today. Source: Security page · Security policy set v1.0 (available under NDA, DPA §12)

VULN-03 How do you patch infrastructure?

Not applicable SweetNote runs no servers, so operating-system and infrastructure patching is done by the managed providers (Supabase, Netlify, Mux). Third-party packages are pinned to exact versions and upgraded when an advisory applies. Source: Security policy set v1.0 (available under NDA, DPA §12) · Subprocessor list §1

VULN-04 How can someone report a vulnerability?

Yes Email security@thesweetnote.com. Reports are acknowledged within one business day, and good-faith research has safe harbor under disclose.io principles. Source: Security page, Vulnerability disclosure

VULN-05 Do you run a bug bounty?

Not yet A public bug bounty launches alongside the SOC 2 Type 1. Source: Security page, Vulnerability disclosure

Logging and monitoring.

LOG-01 Do you keep audit logs of privileged and account actions?

Yes Operator actions and workspace actions (integrations, role changes, account actions, deletion-request fulfillment) are logged. Both logs are append-only in the database and kept for at least 7 years. Source: DPA §13 · Security policy set v1.0 (available under NDA, DPA §12)

LOG-02 Can we see or export our workspace audit log?

Partly Owners and Admins can view their workspace audit log in the portal, filtered by person and action. Exporting it is not available yet. Source: DPA §13

LOG-03 How do you monitor errors and availability?

Yes Sentry monitors errors on the portal and server functions, with email addresses and access tokens redacted, query strings stripped, and no headers, cookies or request bodies sent. Better Uptime monitors public endpoints. Health checks on scheduled jobs alert the operator to a failed retention job, a lost payment or an open incident. Source: Subprocessor list §1 · Security page, Subprocessors · Security policy set v1.0 (available under NDA, DPA §12)

LOG-04 Do you run a SIEM or a 24/7 security operations center?

No Alerts from error monitoring, uptime monitoring and job health checks go directly to the founder; there is no around-the-clock security operations center. Source: Security policy set v1.0 (available under NDA, DPA §12)

Privacy (CCPA, US state laws, GDPR).

PRIV-01 What is SweetNote's role under privacy law?

Yes You are the controller (a business under CCPA / CPRA); SweetNote is your processor and service provider, acting on your documented instructions. Source: DPA §3

PRIV-02 Do you sell or share personal data?

No SweetNote does not sell or share Personal Data, does not use it for cross-context behavioral advertising, and does not profile individuals or make automated decisions about them. Source: Privacy notice §3 · Privacy notice §12

PRIV-03 Which privacy laws do you support?

Yes CCPA / CPRA and the comprehensive US state privacy laws named in the privacy notice, plus Illinois BIPA by architecture (no biometrics). Recipients' rights to know, delete, correct and opt out are honored. Source: Privacy notice §12 · Procurement bundle, Security overview

PRIV-04 Do you support GDPR or UK GDPR processing?

Not yet The service is US-only today, and EU, UK and other non-US recipient data must not be uploaded. Before any non-US data is accepted, the required transfer mechanisms and safeguards will be published and added to the DPA. Source: DPA §9

PRIV-05 How do you help us answer data subject requests?

Yes We provide the technical means to find, export, correct or delete a recipient's data within 10 business days of your routed request. If a person contacts SweetNote directly, we forward the request to you within 5 business days. Source: DPA §10

PRIV-06 Have you completed a data protection impact assessment?

Yes Yes, for the Outcome Attribution processing, available under NDA. An assessment is completed before any new processing that is likely to be high risk. Source: DPA §12.1

PRIV-07 Is Global Privacy Control honored?

Yes Yes, absolutely: on a GPC signal only the server-side open and a record that the signal was honored are kept. Source: Security page, What we record

PRIV-08 How is recipient consent handled?

Yes Opens and plays are recorded for everyone under legitimate interest. A reaction or call-to-action tap is itself the recipient's affirmative action and is not recorded after the recipient declines. Watch depth is measured only after the recipient opts in. Under Global Privacy Control only the server-side open is kept. Consent choices are versioned and kept 5 years. Source: Privacy notice §5 · Security page, What we record

PRIV-09 Do you process biometric data?

No No camera, microphone, face, voice or other biometric capture. Biometric features at the video provider are disabled, the configuration is audited each quarter, and an attestation is available on request. Source: DPA §14.1 · DPA §14.2

PRIV-10 Do you process children's data?

No The service is for adult recipients, and the customer warrants that no recipient is a minor. Source: Privacy notice §8.1

Use of AI.

AI-01 Is our data used to train AI or machine-learning models?

No Your Personal Data, recipient engagement events and conversion data are never used to train, fine-tune or evaluate any AI or machine-learning model, SweetNote's or anyone else's. Source: DPA §4

AI-02 Does the service use AI to process our data?

No No AI model analyzes recipient data, and the service makes no automated decisions about individuals. AI coding assistants work under the founder's account within the policy described below. The one automated speech feature is the video provider's auto-generated captions on your video, for accessibility; it produces a text transcript and no biometric identifier. No automated content moderation, classification or biometric analysis runs on customer video. Source: DPA §14.2 · Privacy notice §3 · Subprocessor list §2

AI-03 Do you use AI tools to build the product?

Yes Yes. Code is written with AI coding assistants under a written policy: every change goes through a pull request with automated checks, changes the assistants build get an independent review, and the assistants make no production database write, email, publication or spend without the founder's approval. Source: Security policy set v1.0 (available under NDA, DPA §12)

Insurance.

INS-01 Do you carry cyber liability insurance?

Yes Yes, covering data-breach response, regulatory defense and third-party privacy liability, at limits shown on the Certificate of Insurance. Source: MSA §9.5

INS-02 What other insurance do you carry?

Yes Commercial General Liability of at least $1,000,000 per occurrence and $2,000,000 aggregate, and Professional Liability (Errors and Omissions) of at least $1,000,000 per claim and $2,000,000 aggregate. Source: MSA §9.5

INS-03 Can you provide a Certificate of Insurance or add us as additional insured?

Yes Email legal@thesweetnote.com; the carrier usually issues the certificate within 1 to 2 business days. Additional-insured status is granted on request on the general liability policy, primary and non-contributory, with waiver of subrogation. We tell you within 5 business days of any lapse or material reduction in cover. Source: MSA §9.5 · Procurement bundle, Vendor onboarding

Personnel.

HR-01 Are personnel bound by confidentiality?

Yes Anyone authorized to process Personal Data is bound by written confidentiality obligations, access is on a need-to-know basis, and access is logged. Source: DPA §6

HR-02 Do you run background checks?

No Not today. SweetNote is founder-operated, and the founder is the only person with access to production systems and Personal Data. The personnel policies are revisited, and onboarding controls put in place, before anyone else is given system access. Source: Security policy set v1.0 (available under NDA, DPA §12)

HR-03 Do you provide security awareness training and an acceptable use policy?

Partly The policy set adopted on 2026-09-28 requires a security-awareness refresher (phishing, credential handling, incident reporting) once a year and before anyone new receives system access; the first refresher is not yet recorded. The acceptable-use policy keeps production systems for SweetNote business only, credentials in a password manager, and customer data out of personal accounts and unmanaged storage. Source: Security policy set v1.0 (available under NDA, DPA §12)

Physical security.

PHYS-01 Do you operate offices or data centers that hold our data?

Not applicable No. SweetNote is cloud-only, with no data centers, server rooms or on-premises systems. Physical security for hosting is provided by the subprocessors listed above. Source: Subprocessor list §1 · Security policy set v1.0 (available under NDA, DPA §12)

PHYS-02 How are administrative devices secured?

Partly Policy requires the administration laptop to have full-disk encryption, a screen lock of 5 minutes or less, automatic operating-system updates and a firewall. The quarterly screenshot check of those settings starts with the first access review, which is not yet recorded. Source: Security policy set v1.0 (available under NDA, DPA §12)