# How do I complete a security questionnaire or vendor risk assessment for Cyber Crucible?

**Short answer:** Most questions are answered by the data governance material — what is collected, what is never collected, how it is protected in transit, where it is processed, and what deployment models are available. For anything requiring signed documentation, contact **dpo@cybercrucible.com**.

## The answers most questionnaires need

| Typical question | Where it's answered |
|---|---|
| What customer data does the vendor collect? | *What data does Cyber Crucible collect — and what does it never collect?* |
| Is data shared with or sold to third parties? | *Does Cyber Crucible sell or share customer data with third parties?* |
| How is data encrypted in transit? | *How is Cyber Crucible data protected in transit?* |
| Where is data processed and stored? | *Where is my data processed, and can it stay inside my country?* |
| Sub-processors and supply chain controls? | *How does Cyber Crucible manage supply chain and insider risk?* |
| Third-party or foreign code components? | *Does Cyber Crucible embed third-party libraries or foreign code?* |
| Controller or processor role? | *Is Cyber Crucible a data controller or a data processor?* |
| Cross-border transfer mechanism? | *How are cross-border data transfers handled?* |

## Two answers that commonly surprise reviewers

**On certifications:** Cyber Crucible's security programme is aligned with recognized industry frameworks but **does not currently hold ISO 27001 or SOC 2 certification**. If your process requires certified evidence, raise it early rather than late.

**On data disclosure:** because encryption keys, credentials, and customer files are never collected, there is nothing in those categories to disclose to any party — including under legal process. Several questionnaire items about disclosure, retention, and deletion are answered by the absence of collection rather than by a control.

## Anything not covered

Contact **dpo@cybercrucible.com** with the specific requirement, your jurisdiction, and which deployment model you are evaluating.