Vendor Evaluation Pack
Pre-filled security documents for procurement teams.
What's included
5 documents in one download
30-question security questionnaire
Pre-filled answers on data handling, access control, encryption, incident response, sub-processors, business continuity and personnel. You can paste them into your vendor assessment system.
Data processing agreement (DPA) template
Data processing agreement template under Article 28 GDPR. Fill in the bracketed fields and have your legal counsel review it before signing.
Sub-processor list
Current list of all Scanara sub-processors with their locations, processing purposes, and data transfer safeguards.
Architecture overview
Infrastructure diagram covering the scan pipeline, data flows, AWS service dependencies, and security boundaries.
EU data residency confirmation
Written statement of where customer data is stored (AWS eu-west-1, Ireland), the one sub-processor outside the EU (GitHub) and how transfers are covered.
Download
Get the pack
Security posture
Key facts for procurement
Data location
AWS eu-west-1 (Ireland)
Encryption
AES-256 at rest · TLS 1.2+ in transit
Certifications
None held yet. ISO 27001 in preparation; SOC 2 planned.
FAQ
Frequently Asked Questions
Does Scanara hold SOC 2 or ISO 27001 certification?
No. Scanara holds no SOC 2 report and no ISO 27001 certificate yet. ISO 27001 is in preparation and SOC 2 is planned; no dates are published. The certifications of AWS cover the AWS infrastructure only. The pack contains the security questionnaire and the architecture overview. For a security review, write to security@scanara.io.
Where is data stored?
Customer data is stored in AWS eu-west-1 (Dublin, Ireland). Scanara does not keep a full copy of your repository; during a scan, files are read from GitHub (USA) into short-lived memory in eu-west-1. GitHub is the only sub-processor outside the EU. Consent-gated analytics on the public marketing website never touches customer data. The pack contains a written data residency statement.
Do you offer a DPA?
Yes. Scanara concludes a data processing agreement under Article 28 GDPR electronically with the terms of service, on every plan. The pack contains a DPA template for customers who want a signed copy. Enterprise customers can request individual amendments.
What data does Scanara process from my codebase?
Scanara processes source code files for pattern matching during a scan. We don't keep a copy of your repository afterward — but scan findings do include short source code excerpts (the flagged lines plus their immediate context), stored per-tenant as part of your scan results and subject to your plan's retention period. Findings are never shared with other customers.
Whom do I contact with security or legal questions?
Write to security@scanara.io for security questions and to legal@scanara.io for the DPA and other legal questions.