Security Questionnaire
Pre-filled SIG Lite
All 19 SIG Lite risk domains (A through S), answered proactively, starting from one fact: only you hold the keys to your data. Your security team can evaluate DevSafe without scheduling a call or waiting for a response.
What is SIG Lite?
The Standardized Information Gathering (SIG) questionnaire is an industry-standard framework developed by Shared Assessments for evaluating third-party risk. SIG Lite covers 19 risk domains (A through S), from encryption and access control to compliance and AI risk.
Most vendors make you request this document and wait days for a response. We publish it here because transparency is faster than process. Every answer below starts from one fact: only you hold the keys. If we cannot access the data, most risk domains resolve to a single architectural fact rather than a list of policies. If your security or procurement team needs to evaluate DevSafe, this page has the answers.
Only you hold the keys
DevSafe cannot access your code or backups, even if compelled. Encryption happens on your machine with your key. We never receive it. This architectural fact simplifies many SIG Lite answers: we cannot leak, train on, or share code and backups we never receive. This is not a policy. It is how the product is built.
Each domain below shows a relevance level indicating how directly that risk domain applies to DevSafe.
Risk domains
A. Enterprise Risk Management MEDIUM
HXA Labs maintains a risk management framework appropriate to its size and operating model. Security review processes are documented. The company operates under a priority stack: Safety > Truth > Trust > Quality > Capability. All product and engineering decisions are evaluated against this hierarchy. The founder is Deaf, which ensures accessibility is a core value rather than an afterthought. WCAG 2.1 AA is the accessibility target for all web properties.
B. Nth Party Management HIGH
Eight sub-processors: Supabase (database, sign-in, server functions), Cloudflare (hosting, CDN, WAF), Stripe (payments), Resend (email), Google (web fonts and the team inbox), Anthropic (answers to the Ask Voss box on blog posts), jsDelivr (delivers the sign-in library to browsers) and GitHub (GitHub sign-in, downloads and the program's update check). None of these sub-processors access customer code or backups. The sub-processor list is published on the Trust Center. Customers receive 30-day notice before any changes to the sub-processor list.
C. Information Assurance HIGH
AES-256-GCM encryption is performed client-side before backup data leaves the customer's machine. Encryption keys are generated locally and never sent to DevSafe (a recovery copy, locked with the customer's recovery code, is kept only in the customer's own storage). DevSafe has no access to customer code or backups.
D. Asset and Information Management HIGH
Customer data classification: Service data is handled by DevSafe: account details, plan and billing records, and, when a user signs in the DevSafe program, project records (project names, local folder paths, remote addresses, backup sizes, commit IDs, and scan findings with file paths and line numbers). Customer code and backups are encrypted and stored in customer-owned infrastructure. DevSafe never stores or has credentials to access customer storage. Data retention: account, project and plan records are deleted when the account is deleted. Fixed time limits for other records (signup check records, email list, form entries, logs) are not yet set.
E. Human Resource Security LOW
Standard security awareness practices are in place. HXA Labs is a small, founder-led team with a security-first culture. Because only customers hold their keys, the human risk surface is small: even with full infrastructure access, team members cannot decrypt customer backups.
F. Physical and Environmental Security N/A
DevSafe operates no physical infrastructure. DevSafe's website and application are hosted on Cloudflare Pages. Customer backups are stored in customer-owned Cloudflare R2 or S3 buckets (not DevSafe infrastructure). Supabase provides managed PostgreSQL for auth and account data. Physical security responsibilities are delegated to these sub-processors, each of which maintains their own SOC 2 and ISO 27001 certifications.
G. IT Operations Management MEDIUM
DevSafe is a single Go binary that needs only git at runtime. No Docker, no Node.js, no Python. Deployments to Cloudflare Pages are immutable with instant rollback capability. SSL certificates are provisioned automatically. The database runs on Supabase (managed PostgreSQL with encryption at rest). DevSafe operates no self-managed servers. Server patching, hardening, and OS-level security are the responsibility of the managed service providers.
H. Access Control HIGH
Authentication methods: email and password, magic link (email), or GitHub OAuth. Optional TOTP multi-factor authentication. Passwords hashed by Supabase Auth, never accessible to DevSafe. Sessions are managed through Supabase Auth with JWT tokens. The principle of least privilege is applied across all systems. Team plans support role-based access with Owner and Member roles.
I. Application Security HIGH
DevSafe ships as a single Go binary compiled from source with a minimal dependency chain. All database access uses parameterized queries. Input validation is enforced on every request. CORS is locked to devsafe.com. Security headers are deployed: HSTS, Content Security Policy, X-Frame-Options, and X-Content-Type-Options.
J. Cybersecurity Incident Management MEDIUM
An incident response plan is documented. Breach notification is provided within 48 hours. The scope of any potential breach is limited to service data (account details, billing records, and project records such as project names and folder paths). Customer code and backups are encrypted and inaccessible to DevSafe even in a breach scenario. Because DevSafe never holds customer keys, a compromise of DevSafe infrastructure cannot expose customer source code.
K. Operational Resilience MEDIUM
Customers can restore their backups with the free DevSafe program and their key, with no DevSafe account and no DevSafe server. No vendor lock-in. Backups are stored in customer-owned storage and survive DevSafe outages, account changes, or service discontinuation.
L. Compliance Management HIGH
GDPR: Aligned. Privacy by design. Data subject rights supported. DPA in draft, available on request after legal review. HIPAA: Technical safeguards addressed by encrypting data on the customer's machine with keys only the customer holds. BAA template in preparation. SOC 2 Type II: Observation period target 2027. CCPA: Aligned. No sale of personal data.
M. Endpoint Device Security LOW
The DevSafe CLI runs on customer endpoints as a standard user-level process. No privileged access or administrator rights required. Backups read repositories without changing them; restores write only where the user asks. The binary installs no kernel extensions or system-wide services. Optional features the user turns on, such as a backup schedule (a user-level launchd or systemd timer) and git or AI tool hooks, live only in the user's own account and can be removed by the user.
N. Network Security MEDIUM
DDoS protection is provided by Cloudflare. A Web Application Firewall filters malicious requests. Bot detection and blocking are enabled. TLS 1.2 or higher to DevSafe infrastructure and storage providers. HTTPS is required by default. Plain HTTP is allowed only to self-hosted storage on a private network, or when the customer turns on an explicit setting, and DevSafe prints a warning each time. Private networking is used between internal services.
O. Privacy HIGH
Only customers hold their keys. No advertising or third-party tracking tags; the website may use Cloudflare's cookie-free Web Analytics. No customer data used for training. Customer code is never seen, shared, or sold. GDPR data subject rights are supported. CCPA aligned: no sale of personal data. Privacy is architectural, not policy-based. DevSafe cannot access customer data even if it wanted to.
P. Threat Management MEDIUM
Cloudflare WAF and DDoS protection are active on all endpoints. Rate limiting is enforced on all API endpoints. Bot detection and blocking prevent automated abuse. The threat surface is intentionally small: a single Go binary that needs only git, and no self-managed servers.
Q. Supply Chain Risk Management HIGH
DevSafe ships as a single Go binary with a minimal, audited dependency chain. Every dependency is a documented trust decision. No runtime package managers, no dynamic module loading. The CLI has no runtime dependencies beyond the compiled binary and git. Sub-processors are the eight listed under third-party risk (Supabase, Cloudflare, Stripe, Resend, Google, Anthropic, jsDelivr, GitHub). Because no sub-processor ever holds customer keys or backups, a supply chain compromise of any sub-processor cannot expose customer code or backups.
R. Artificial Intelligence Risk N/A
DevSafe does not use AI or machine learning in any part of the backup, encryption, or storage pipeline. No customer data is used for model training. No AI-generated decisions affect data handling, access control, or encryption. Backup, encryption, and storage follow fixed rules written in code. If HXA Labs introduces AI features in the future, they will operate under the same constraint: DevSafe holds no customer keys, so no DevSafe AI system can access customer code or backups. The only AI DevSafe uses today is the optional Ask Voss box on blog posts, which sends a website visitor's question to Anthropic; it never touches customer code, keys or backups.
S. Cloud Hosting Services HIGH
Customer backups are stored in customer-owned Cloudflare R2 or S3-compatible buckets. DevSafe never stores backups and never has credentials to access customer storage. The customer controls their storage, their keys, and their data lifecycle. Supabase provides auth and database services with encryption at rest. HXA Labs is a tenant of its cloud providers, not an operator of cloud infrastructure.
Need a deeper review?
If your organization requires a full SIG Core questionnaire, a custom security review, or additional compliance documentation, our team is ready to help.
Request Custom ReviewFor security-specific inquiries, responsible disclosure, or compliance document requests, contact the security team.
See also: Trust Center · Security & Threat Model · Privacy Policy