T38 Security review and procurement pack
Security review and procurement pack
Everything Marrow Capital's security and procurement team needs to evaluate Vaultline, organized by domain, with the questions still open. Prepared by Priya Chandran, Security Lead, for your review.
This pack is confidential
This document contains Vaultline's security posture in detail and is shared under the mutual NDA signed Sep 8, 2026. Do not forward outside your evaluation team without our security team's consent.
Sample template: the firm, people, clients and figures are fictional and shown for illustration only.
Controls summary
| Domain | Control | Status | Evidence |
|---|---|---|---|
| Access control | SSO with SAML 2.0, enforced MFA for all staff | SOC 2 report, section 4.2 | |
| Encryption | AES-256 at rest, TLS 1.2 minimum in transit | Penetration test summary, attached | |
| Data residency | US-only processing and storage, no offshore support access | Subprocessor list, below | |
| Logging | Centralized audit log, 400 days retention | SOC 2 report, section 5.1 | |
| Vulnerability management | Quarterly external pentest, continuous internal scanning | Latest pentest dated Jul 2026 | |
| Business continuity | RPO 15 minutes, RTO 4 hours, annual failover test | Last failover test overdue, see below |
Security domains in detail
Access control and identity
Vaultline requires SAML-based SSO for all customer accounts on the Ledger platform and enforces MFA for every internal engineer with production access. Production access is granted through a role-based system reviewed quarterly, and access is revoked within 24 hours of an employee's departure. We support customer-managed SCIM provisioning on the Enterprise plan.
Encryption and key management
Data at rest is encrypted with AES-256 using AWS KMS, with customer-specific keys available on the Enterprise plan. Data in transit uses TLS 1.2 or higher everywhere, including internal service-to-service calls. Payment account numbers are tokenized before storage; Vaultline never stores raw card numbers.
Data residency and subprocessors
All processing and storage occurs in AWS us-east-1, with us-west-2 as a warm standby region. Vaultline uses four subprocessors: AWS (hosting), Twilio (SMS verification), SendGrid (transactional email) and Stripe (payment processing passthrough). The full subprocessor list with data flows is in the appendix.
Incident response
Vaultline maintains a documented incident response plan tested twice a year. Customers on the Enterprise plan receive notification of a confirmed security incident affecting their data within 72 hours, consistent with our data processing agreement. The last tabletop exercise ran May 2026.
Business continuity and disaster recovery
Recovery point objective is 15 minutes and recovery time objective is 4 hours, backed by continuous database replication to us-west-2. The annual failover test is contractually required and was due in Q2 2026; it has not yet run because of a platform migration that took priority. Owner: VP Infrastructure, Tobias Lund. Target: complete by Oct 31, 2026.
How customer data flows
flowchart LR
A[Marrow Capital users] -->|TLS 1.2, SSO| B[Vaultline Ledger app]
B -->|Encrypted| C[(Primary database, us-east-1)]
C -.replication.-> D[(Standby database, us-west-2)]
B --> E[Stripe, payment processing]
B --> F[Twilio, SMS verification]
B --> G[SendGrid, transactional email]
B --> H[Centralized audit log]
No subprocessor other than the four listed above receives customer data. Support staff access production data only through logged, time-boxed sessions, never through direct database access.
Documents we can provide on request
Open questions
| Question from Marrow Capital | Raised | Owner | Status |
|---|---|---|---|
| Confirm failover test completion date before contract signature | Sep 18, 2026 | Tobias Lund, VP Infrastructure | |
| Provide a signed copy of your standard security questionnaire in our format | Sep 20, 2026 | Priya Chandran | |
| Confirm whether Enterprise plan includes customer-managed encryption keys at current tier | Sep 20, 2026 | Priya Chandran |
Four out of five. The one open item, the overdue failover test, is the reason we are not calling this pack complete; we will update this page the day the test finishes.
Next steps
- Marrow Capital's security reviewer confirms whether the overdue failover test is a blocking condition for contract signature.
- Vaultline delivers the completed failover test results by Oct 31, 2026.
- Both teams schedule a 30-minute call to close remaining questions before the target signature date.
How to use this template
Duplicate this page per prospect security review. Replace the values below from the deal record and your security team's tracker; if a control's evidence is not yet available, mark it Needs review rather than claiming it is implemented.
| Variable | Meaning | Required |
|---|---|---|
{{prospect.name}} | Company whose security team is reviewing you | Required |
{{review.date}} | Date this pack was prepared or last updated | Required |
{{security.lead_name}} | Vendor security lead who owns this pack | Required |
{{compliance.certifications}} | Current certifications and their status | Required |
{{openquestion.text}} | Any open question, its owner and status | Optional |
{{control.evidence_link}} | Where the underlying evidence document lives | Optional |
Never mark a control Implemented without current evidence on file, and never share this pack outside a signed NDA.