Security & Compliance

Security

What DDoS protection and rate-limiting controls are in place?

Auth0 enforces rate limiting on login attempts and blocks IP addresses after repeated failed attempts. AWS GuardDuty provides continuous intrusion detection across our infrastructure. The frontend is served via CloudFront, which includes AWS Shield Standard for DDoS protection.

How does GlassDollar approach threat modeling and risk assessment?

GlassDollar conducts structured risk assessments as part of its ISMS, aligned with ISO/IEC 27001 and TISAX. The process covers scoping critical assets, mapping data flows, and systematically identifying threats and vulnerabilities. Each risk is evaluated using a likelihood × impact matrix (1–4 scale) to produce a prioritized risk rating. Vulnerabilities are identified through quarterly external vulnerability scans, annual penetration testing, dependency scanning (GitHub Dependabot, Snyk), internal and external audits, and the CVE database. Security risks are assessed at key stages of the SDLC. All risks are recorded in a centralized risk register with treatment plans, reviewed annually by the ISMS Governance Council. Remediation SLAs are: Critical – 7 days, High – 30 days, Medium – 60 days, Low – 90 days.

How do you manage secrets and credentials?

We avoid hard-coding secrets in code and restrict access to production credentials.

We also rotate P1 secrets.

How is network access controlled?

Our cloud infrastructure follows least-privilege access principles and restricts access to sensitive components.

Do you have a vulnerability management process?

We can provide our vulnerability management approach upon request.

How are changes managed?

Changes are managed through controlled processes with the ability to roll back.

Do you follow secure development practices?

We apply secure development practices and change control for application and infrastructure changes.

Is data encrypted at rest?

We typically rely on encryption-at-rest features provided by our cloud services for stored data.

Is data encrypted in transit?

We use HTTPS/TLS to encrypt data in transit between clients and our services.

Do you publish a security.txt file or have a documented process for external researchers to report security issues?

GlassDollar maintains a clear channel for security disclosures: external researchers and customers can report security issues directly to security@glassdollar.com, and we triage every report. Publishing a security.txt file is on our roadmap as an additional discoverability mechanism, in line with RFC 9116. Our overall vulnerability-management process was reviewed during our April 2026 CREST-accredited penetration test (Redcentric, ref 049482), which raised no critical or high-severity findings against our security operations.

How do you handle session management — concurrent sessions, session timeout, and in-app password change?

For SSO customers — our recommended setup — session lifecycle, timeout, and credential management are handled by your own identity provider, so your existing policies apply directly. Our April 2026 CREST-accredited pentest (Redcentric, ref 049482) confirmed our session management follows good practice, with secure session tokens and consistent server-side validation.

Do you have HSTS and DNS CAA records configured on all your domains, including file hosting domains?

TLS is enforced on every GlassDollar domain, and our DNS and TLS configuration was independently validated as meeting good practice during our April 2026 CREST-accredited penetration test (Redcentric, ref 049482). For file-hosting domains (files.glassdollar.com, documents.glassdollar.com), which serve files rather than rendered web content, we apply controls appropriate to the threat model — the risk profile differs from an interactive web app. We’re happy to share specific DNS/TLS evidence on request.

What HTTP security headers (CSP, HSTS, X-Frame-Options, etc.) do you implement?

HTTPS is enforced across all GlassDollar endpoints, and our TLS configuration was independently confirmed to meet good practice during our April 2026 CREST-accredited penetration test (Redcentric, ref 049482). Browser-facing security headers are continuously reviewed and tightened as part of our standard hardening process. For our file-hosting domains (files.glassdollar.com, documents.glassdollar.com), which serve files rather than rendered web content, we apply controls appropriate to the threat model — some browser-targeted headers like CSP and X-Frame-Options carry no risk reduction in that context.

What is your password policy (complexity, length, rotation)?

For SSO customers — our recommended setup — password policy is governed entirely by your own identity provider, so your existing complexity, rotation, and lockout standards apply unchanged. For direct accounts, GlassDollar enforces a baseline password policy and our authentication layer was reviewed in the April 2026 independent CREST-accredited penetration test (Redcentric).

Do you enforce multi-factor authentication (MFA) for all user accounts?

GlassDollar supports Single Sign-On (SSO) for all customers and recommends it as the primary authentication path. With SSO, MFA is enforced through your own identity provider — meaning your existing MFA, conditional access, and session policies apply directly to GlassDollar without us holding a separate factor for your users. This was reviewed in our April 2026 independent CREST-accredited penetration test (Redcentric), which raised no critical or high-severity authentication findings.

AI Governance

Does the AI-related functionality use any open-source software, code, or libraries? If yes, which ones?

Yes — open-source components are used as supporting application libraries only. No open-source AI model is used; model inference is provided entirely by Azure OpenAI. The open-source libraries involved are: @ai-sdk/azure and ai (SDK utilities for calling Azure OpenAI and handling structured generation), zod (schema validation for structured AI inputs/outputs), @prisma/client / prisma (database access for AI-related workflows and stored context), and lodash (data transformation and filtering utilities around recommendation and search results).

What are the AI model inputs and outputs? What type of data does the AI receive, and what form do the outputs take?

Inputs are a mix of structured and free-text business context provided by users, including problem statements, desired outcomes, requirements, additional context, known example companies, and existing related companies. Outputs are structured recommendation records that can include identifiers, numerical scores, categorical/status fields, match metadata, and limited generated text such as labels or highlights.

Do employees receive AI-related training?

Yes. Annual training covers AI safety, prompt hygiene, data handling, bias/harms awareness, and incident reporting.

Do you maintain documentation and evidence for AI use?

Yes. We document AI use cases and retain evidence such as change tickets, risk assessments (e.g., DPIAs), access reviews, logging dashboards, and incident records.

What requirements apply to third-party AI providers?

We use only company-managed Azure OpenAI subscriptions, enforce enterprise identity, and configure the provider to disable training on customer content.

Do you restrict sensitive data in prompts?

Yes. We require data minimization and prohibit sharing secrets/credentials or special-category data in prompts unless approved via DPIA.

Do you log and monitor AI activity?

Yes. Our AI governance requires logging of inputs/outputs metadata and system decisions, while avoiding unnecessary sensitive content.

Is there human oversight of AI outputs?

Yes. Oversight is performed by the end user: the platform provides disclosures and context so users can assess AI suggestions before acting.

How do you classify AI risk under the EU AI Act?

We act primarily as a deployer of third-party AI components, and our known use cases are classified as limited-risk.

Where is AI inference hosted?

AI model inference is hosted by Azure OpenAI in France.

What do you use AI for?

We currently use AI for a conversational assistant to help users search for companies and for recommendations of innovation topics and startups.

What data is processed by AI features?

AI features may process limited user and organizational context relevant to the task, such as job title, department, organization name, user interest labels, and user-provided inputs.

Do you train or fine-tune models on customer data?

No. We use Azure OpenAI models as-is and do not fine-tune them on customer data.

Which AI provider/models do you use?

Our AI provider is Azure OpenAI, using GPT-4o and GPT-4o-mini. We use these models as-is and do not perform fine-tuning.

Do you have an AI governance policy?

Yes. We maintain an internal AI governance policy that defines requirements for responsible, secure, and compliant AI use.

Infrastructure & Hosting

From which geographic areas can the platform / AI system outputs be consumed? Can the client restrict or influence this?

Authorized users can use GlassDollar from locations your organization permits, over the internet, with access governed by your policies and SSO where configured. Core hosting and storage run in the European Union (AWS Frankfurt, eu-central-1). AI features use Microsoft Azure OpenAI in EU regions. We do not offer separate geographic “editions” of the service; your controls define who may sign in. For specific contractual deployment needs, speak with your GlassDollar contact.

Describe failover architecture and redundancy across regions.

Physical infrastructure is fully managed by AWS within the eu-central-1 (Frankfurt) region. We maintain multiple clusters to ensure redundancy and failover capability in case of emergency. Data is redundantly stored across multiple availability zones, with automatic replication and integrity checks. AWS manages all physical security, power, cooling, and network redundancy for the hosting environment.

Specify geographic locations of test, staging, and production environments.

All environments (test, staging, and production) are hosted on AWS in the eu-central-1 (Frankfurt) region. Development, testing, and production environments are maintained as distinct, separate environments.

Do you use a search index or analytics datastore?

We use Qdrant for search and analytics use cases.

Where do you store file uploads/attachments/exports?

We use AWS S3 for object storage such as attachments and exports.

What database do you use for application data?

Our primary relational database is PostgreSQL.

What backend technologies do you use?

Our primary API is a GraphQL endpoint provided via Hasura GraphQL Engine backed by PostgreSQL.

How is the frontend hosted?

Our single-page web app is served via Amazon S3 and CloudFront.

Can you describe your high-level architecture?

We run a web-based single-page application with a backend API and database hosted on AWS.

Where is your primary hosting region located?

Our primary hosting region is AWS eu-central-1 (Frankfurt, Germany).

Incident Response

How do you handle breach notifications?

If a security incident involving customer data occurs, we follow our incident management process and contractual/legal notification obligations.

Do you have an incident response process?

Yes. We maintain an incident management process for security incidents.

Business Continuity & DR

What happens to an active user session when maintenance begins?

User sessions are not interrupted by maintenance. The session remains active and all in-session data is preserved.

Do you provide an uptime SLA?

SLA terms depend on the customer agreement.

What are your RPO/RTO targets?

We can provide RPO/RTO targets upon request.

Do you take backups of production data?

We maintain backups for key production data stores to support recovery in case of incidents.

Data Protection & Privacy

Where can users upload files within the app, and how are those files stored and used?

Files can be uploaded in multiple areas of the platform including project documents, startup profiles, notes, sourcing requests, pitch submissions, and branding assets. All uploaded files are stored in AWS S3 using presigned URLs with a secure private bucket and time-limited download links. GlassDollar does not process or use the content of uploaded documents — users decide how their documents are used within the platform.

Is data (parts of it) processed outside of the EU?

No. All data is processed and stored exclusively within the EU. No data is transferred or processed outside the European Economic Area (EEA).

Can customers export their data?

We support data export mechanisms to help customers retrieve their information.

Can you delete our data on request or at contract end?

We support customer data deletion in line with contractual terms and applicable legal requirements.

What is your data retention policy?

We retain customer data only as long as needed for service delivery and legitimate business purposes, subject to contractual requirements.

Where is customer data processed/stored?

Core application workloads are hosted in AWS eu-central-1 (Frankfurt).

Who are your key subprocessors?

Key subprocessors typically include AWS (hosting), Auth0 (authentication), and Sentry (monitoring).

Can you sign a Data Processing Agreement (DPA)?

We can provide and sign a DPA as part of customer contracting.

Are you GDPR compliant?

We operate with GDPR as our primary privacy framework and handle personal data in line with GDPR principles.

Identity & Access

How does user access via SSO change when the platform transitions from development to production?

SSO is configured directly in the production environment. There is no separate development or staging phase for SSO setup — once a customer provides their IdP details, the connection is established in production via Auth0.

Describe the availability of test, staging, and production environments for SSO and SCIM testing.

GlassDollar maintains distinct environments for development, testing, and production. SSO is configured directly in the production environment upon customer request via Auth0. Auth0 guarantees 99.99% monthly availability for core authentication services on enterprise plans and supports federation via SAML and OIDC with major enterprise identity providers. A separate staging validation step for SSO is not required. SCIM provisioning is not currently supported.

What are the required setup details and user attributes for configuring SSO?

To set up SSO, customers need to provide the following from their Identity Provider (IdP): Client ID (the application identifier issued by the IdP), Client Secret (required for the back-channel OIDC method), and Issuer URL (the OpenID Connect discovery endpoint, e.g. https://some.domain.com/.well-known/openid-configuration). The IdP must also be configured to pass the following user attributes: email, name, and department. Supported SSO connection types include: OpenID Connect (OIDC), SAML, Okta Workforce, Google Workspace, Microsoft Azure AD, ADFS, Active Directory / LDAP, and Ping Federate.

Do you support SCIM provisioning?

SCIM provisioning is not currently supported. Identity and access management is handled via Google Workspace.

Is Internet access blocked for privileged users? If NOT, please elaborate and provide approved exceptions.

No specific policy on blocking Internet access for privileged users exists. However, compensating controls are in place: access to utility programs and software with the potential to bypass system and application controls is limited to the fewest necessary staff (POL-11 Access Control). Cloud infrastructure follows least-privilege access principles and restricts access to sensitive components. The use of privileged, non-personal accounts is permitted only in exceptional circumstances, must be documented, explicitly approved, logged, and deactivated immediately after use.

How is authorization handled?

We use role-based access control (RBAC) based on organization and user context.

Do you support Single Sign-On (SSO)?

We authenticate via Auth0, which supports SSO integrations with common enterprise identity providers.

Do you support Multi-Factor Authentication (MFA)?

MFA can be enforced via Auth0 and/or the customer’s identity provider policies.

Company & Product

Which languages is the platform / AI system implemented for? Is it restricted to specific languages or can the client use any language?

GlassDollar is English-only. The supported product experience — UI, in-app guidance, emails we control, and support — is English. Do not position the platform as multilingual for customers.

AI: AI features run on Microsoft Azure OpenAI (Azure OpenAI in Foundry Models). That service can technically ingest non-English text; GlassDollar does not support non-English use. Treat English as the only supported input/output for AI features. If users paste other languages anyway, behaviour is best-effort, quality is not guaranteed, and it is out of scope for support or SLAs.

Can the client use “any language”? No. There is no supported path to operate the product in French, Spanish, German, etc.

Is the platform multi-tenant?

Yes. Our platform is a multi-tenant B2B SaaS application.

What is GlassDollar?

GlassDollar is a multi-tenant B2B SaaS platform for startup and innovation management.

Logging & Monitoring

Do you have alerting for anomalies or incidents?

We use monitoring to detect and respond to operational issues.

What monitoring or error tracking do you use?

We use Sentry for application error tracking and performance monitoring.

Compliance

Do you have ISO 27001 or SOC 2?

Yes. GlassDollar holds a TISAX Level 2 assessment result, valid until 14.11.2027. The assessment was conducted under Scope S1FXYW (Standard Scope 2.0.1), covering Data Protection according to EU-GDPR Art. 28 (“Processor”) and Confidential information. Assessment IDs: AYGDG1-1, AYGDG1-2, AYGDG1-3 (issued by ENX Association). Results are available to authorized TISAX participants at enx.com/TISAX/tisaxassessmentresults.

Integrations & Subprocessors

Does the platform / AI system require integration with or trigger other client or external systems and applications?

Client-owned systems: No — there is no requirement to plug GlassDollar into the customer’s ERP, CRM, data lake, or other internal applications for standard use. The product is browser-based SaaS.

Optional hooks (customer choice): Many tenants enable SSO (SAML/OIDC) against their IdP via Auth0. Customers may also call GlassDollar’s HTTP APIs from their own systems if they have agreed access and credentials. Those are elective integrations, not a baseline prerequisite.

External systems GlassDollar uses: Normal operation does call GlassDollar’s sub-processors (hosting, database/API layer, transactional email, error/analytics tooling, Microsoft Azure OpenAI for AI inference, etc.). That traffic is from GlassDollar to our vendors, not “GlassDollar must be installed inside your VPC”.

Does AI trigger other systems? AI requests go to Azure OpenAI as part of our stack. They do not require the customer to operate Azure or wire AI into their estate by default.

Outbound automation into customer apps: Not part of the standard product contract path; anything bespoke is project-specific.

Does GlassDollar offer native integrations with third-party tools?

GlassDollar does not offer native built-in integrations with third-party tools or platforms. All data exchange is facilitated through our GraphQL API, which supports authenticated access using JWT tokens issued by Auth0 (OAuth 2.0 / OIDC). This gives customers full control over what data is shared, how it is consumed, and which systems are connected, while maintaining consistent authentication and authorization standards.