Security Questionnaire Answers

For procurement

The security questionnaire, answered before you send it

These are the questions we get asked most often, with honest answers including the two that are still a no.

Data and residency

Is data encrypted at rest and in transit?

Yes

AES-256 at rest, TLS 1.3 in transit, with keys rotated quarterly.

Can we choose the region our data lives in?

Yes

UK, Ireland, or Germany, chosen at setup. Backups stay in the same region.

Is there a documented retention and deletion schedule?

Yes

Published, versioned, and referenced from the data processing agreement.

Access and identity

Do you support single sign-on?

Yes

SAML and OIDC on the Group plan, with SCIM provisioning alongside it.

Is staff access to member data logged?

Yes

Every read, grant, and export is written to an immutable log you can query and export.

Can we enforce hardware security keys?

Partial

Enforced through your identity provider today. Native enforcement is on the roadmap for this year.

Assurance

Do you hold ISO 27001?

Partial

Audit is underway with certification expected in the fourth quarter.

Do you run external penetration tests?

Yes

Annually by an independent firm, with the summary shared under NDA.

Do you offer an on-premise deployment?

Not yet

No, and we do not intend to. If that is a hard requirement we are the wrong supplier.

The rest of the pack

Architecture diagrams, the sub-processor register, the DPA, and the last penetration test summary. Sent the same working day, under NDA where it needs to be.

Request the security packRead the trust page
About this block

Security Questionnaire AnswersPRO

A procurement FAQ grouping security controls into hairline rows that pair each question with a tone-coded yes, partial, or not-yet chip and the detail behind it, closing on a security pack request.

Faq90: Security Questionnaire Answers

A procurement FAQ grouping security controls into hairline rows that pair each question with a tone-coded yes, partial or not-yet chip and the detail behind it, closing on a security pack request.

Upgrade to Pro

Pro blocks install through the shadcn CLI with your license key and ship their full source. Docs and live previews stay open to everyone, so you can read every block's details first.

Upgrade Now

Installation

Swap YOUR_EMAIL and YOUR_KEY for the email and license key on your account. Find your license key on your account page.

Radix flavor

bash
npx shadcn add "https://ui.beste.co/r/faq90?email=YOUR_EMAIL&license_key=YOUR_KEY"

Base UI flavor

bash
npx shadcn add "https://ui.beste.co/r-base/faq90?email=YOUR_EMAIL&license_key=YOUR_KEY"

This installs the block to components/beste/block/faq90.tsx plus the badge23 and button21 components it uses for the eyebrow and the pack actions.

Quick start

The installed file exports faq90Demo alongside the block: the exact props behind the preview above. Spread it to get a working questionnaire in one line.

tsx
import { Faq90, faq90Demo } from "@/components/beste/block/faq90";

export default function SecurityPage() {
  return <Faq90 {...faq90Demo} />;
}

Then replace the demo with your own props. Written out, a trimmed setup looks like this:

tsx
import { Faq90 } from "@/components/beste/block/faq90";

export default function SecurityPage() {
  return (
    <Faq90
      badge={{ label: "For procurement" }}
      heading="The security questionnaire, answered before you send it"
      description="Honest answers, including the two that are still a no."
      answerLabels={{ yes: "Yes", partial: "Partial", no: "Not yet" }}
      groups={[
        {
          label: "Data and residency",
          controls: [
            {
              question: "Is data encrypted at rest and in transit?",
              answer: "yes",
              detail: "AES-256 at rest, TLS 1.3 in transit, keys rotated quarterly.",
            },
          ],
        },
        {
          label: "Assurance",
          controls: [
            {
              question: "Do you hold ISO 27001?",
              answer: "partial",
              detail: "Audit is underway with certification expected in the fourth quarter.",
            },
            {
              question: "Do you offer an on-premise deployment?",
              answer: "no",
              detail: "No, and we do not intend to.",
            },
          ],
        },
      ]}
      packTitle="The rest of the pack"
      packBody="Architecture diagrams, the sub-processor register, and the DPA."
      buttons={[
        { label: "Request the security pack", href: "/security/pack" },
        { label: "Read the trust page", href: "/trust" },
      ]}
    />
  );
}

Props

PropTypeDefaultDescription
badge{ label: string }–Eyebrow above the hairline rule, rendered through Badge23
headingstring–Section heading in the left column of the header
descriptionstring–Supporting paragraph, right-aligned from md up
answerLabelsRecord<Answer, string>–The word shown on each answer chip
groupsControlGroup[][]Control groups, each a labelled set of rows
packTitlestring–Heading in the closing pack panel
packBodystring–Paragraph in the pack panel
buttonsActionLink[][]Pack actions, first solid and the rest outlined
classNamestring–Extra classes for the outer section
ts
type Answer = "yes" | "partial" | "no";

type ActionLink = {
  label: string;
  href: string;
};

type Control = {
  question: string;
  answer: Answer;
  detail: string;
};

type ControlGroup = {
  label: string;
  controls: Control[];
};

Behavior notes

  • answer is a three-value union, not a boolean, which is the point of the block: procurement questions rarely have a clean yes or no, and the middle state has somewhere honest to go.
  • Chips carry a colour from the answerStyles table (emerald, amber, muted) plus a word, so the state never depends on hue alone.
  • answerLabels falls back to the raw key when a label is missing, so an incomplete record degrades to "partial" rather than rendering blank.
  • detail is required on every control. A chip on its own answers nothing, so the block forces the caveat to travel with the answer.
  • Rows are a three-track grid from md: question, a fixed 7rem answer column, then the detail. The chip is w-fit, so it hugs its label rather than filling that track.
  • Below md the row stacks into question, chip and detail, keeping the same reading order.
  • Groups use mb-10 with last:mb-0, and each control carries border-t, so rules appear between rows and above the first row of each group.
  • Nothing here filters or collapses. The whole point is that a procurement reader can print the page or search it in one pass.

More FAQ blocks

View all FAQ
FREE

faq84

Hairline Answer Ledger

A compact FAQ with nothing hidden behind a click: three labelled groups of question and answer pairs set as two-column hairline rows, closing on a link to longer reading.

PRO

faq68

FAQ with Side Heading and Numbered Cards

Two-column FAQ section with a badge, heading, and description on the left, and a stacked list of numbered question cards on the right. Each card opens to reveal a plain answer block below it with no separator line.

PRO

faq81

Grouped FAQ Columns

FAQ split into two labelled groups, each an independent accordion of ruled questions, so a long list stays scannable by topic; closed by a response-time note beside an outline pill CTA.

PRO

faq12

Grouped Sections

FAQs organized into titled sections with accordions underneath. Excellent for presenting related questions grouped by topic.

PRO

faq16

Numbered List

Questions displayed with numbered badges and answers below. Ideal for step-by-step guides or priority-ordered FAQs.

FREE

faq80

Two Column Answer Grid

An always-open FAQ laid out as a two-column grid of numbered, hairline-separated question and answer entries, closing with a soft support panel that pairs a short prompt with two actions.