-

Provider: Stressmaniacs GmbH & Co. KG (4chems.com) · Framework: CSA Cloud Controls Matrix / CAIQ (self-assessment) · Scope: the 4chems managed cloud (IUCLID, CHESAR, QSAR Toolbox, IIP). We answer honestly, including where we are not yet certified — see Certifications & roadmap. Sensitive operational artefacts (penetration-test reports, BCP/DR runbooks, Statement of Applicability) are available under NDA at hello [at] 4chems.com. A SIG Lite version is available on request.

Governance, risk & compliance

• Information security management system? Yes — an ISO 27001:2022-aligned ISMS built on six formal policies: POL-SEC-001 (Data Classification), POL-SEC-002 (Vulnerability Management), POL-SEC-003 (Contractor/Access Control), POL-SEC-004 (Backup, Recovery & Business Continuity), POL-SEC-005 (Incident Response), POL-SEC-006 (Risk Management).
• Certifications held? The hosting infrastructure (Hetzner) is ISO 27001 and SOC 2 certified. 4chems’ own ISO 27001 certification is planned (roadmap) — we are currently aligned, not certified. We do not yet hold SOC 2 Type 2 or BSI C5 Type 2; this CAIQ is provided in their place.
• Risk management? Structured process aligned to ISO 27001 Clause 6.1; a risk register is maintained and reviewed quarterly.
• Compliance verification? Annual internal reviews against the ISMS by qualified personnel; management review.
• External audit reports? None yet; planned alongside ISO 27001 certification.

Data security & privacy

• GDPR role? You are the controller; 4chems is the processor under a signed DPA (Art. 28).
• Data residency? EU/EEA only. No personal data is transferred outside the EU/EEA.
• Encryption at rest? AES-256 for all stored data and backups; full-disk encryption on all company endpoints.
• Encryption in transit? TLS 1.2+ everywhere; HTTPS enforced; encrypted internal service channels; VPN with mutual authentication for admin access.
• Tenant isolation? Logical partitioning at database and application layer; per-customer isolated schemas/databases with app-level access control.
• Pseudonymisation/anonymisation? Supported.
• Data subject rights? Documented procedures for access, rectification, deletion, restriction, objection, portability and consent withdrawal.
• Data deletion? Secure sanitisation; logical deletion at application layer; audit logs of data changes retained.
• Use of customer data? Never for our own purposes; never to train models.
• DPO? No dedicated DPO (not legally required under Art. 37); data-protection responsibilities sit with management.

Identity & access management

• Access model? Least-privilege, need-to-know and segregation-of-duties; no shared accounts; access reviewed quarterly and revoked immediately on termination (POL-SEC-003).
• MFA? Required for all system access; VPN + MFA for all remote and administrative access.
• Customer SSO? OpenID Connect (OIDC) federation with Azure AD / Entra ID (4chems acts as identity broker) — in production today.
• Password policy? Technically enforced (length, complexity, MFA).

Threat & vulnerability management

• Vulnerability scanning? Automated and continuous — container image scanning (Trivy), dependency scanning (Dependabot), infrastructure scans; on all exposed systems quarterly or more, classified by CVSS.
• Patch SLAs (POL-SEC-002)? Critical (CVSS 9.0+) ≤48 h, High (7.0–8.9) ≤7 d, Medium ≤30 d; end-of-life software avoided.
• Penetration testing? None performed to date. Compensating controls: continuous scanning above, plus pen testing before major releases as part of an OWASP ASVS Level 2 SSDLC. An external penetration test is planned for H1 2027 (ISO 27001 roadmap).
• Anti-malware? On all systems.

Application & supply-chain security

• Secure SDLC? OWASP ASVS Level 2 baseline; OWASP Top 10 secure coding; code-review checklists; SAST/DAST and dependency scanning in CI.
• Sub-processors? For customer IUCLID data (all EU/EEA): Hetzner Online GmbH (DE, hosting), self-hosted mail (Mailcow/Postfix/Dovecot, DE), Better Stack (availability monitoring — infra metrics only). For supporting functions with no customer IUCLID data: Amazon Web Services (Route 53 DNS and Amplify marketing-website hosting). All under DPAs with equivalent obligations, reviewed annually; security obligations embedded in all third-party contracts.

Logging, monitoring & incident response

• Logging? Audit logging and file-integrity monitoring on production; audit events retained ≥1 year. SIEM and DLP are on the roadmap.
• Email security? DMARC, DKIM and SPF in place.
• Incident response (POL-SEC-005)? Documented detection → triage → containment → investigation → notification → eradication → post-incident review; severity P1–P4 with response SLAs; forensic snapshots before remediation; tested annually; post-incident review after every P1/P2.
• Breach notification? Customer notified within 48 h of a confirmed P1/P2 incident; GDPR supervisory-authority notification within 72 h (Art. 33).
• Incidents in the last 24 months? None.

Business continuity & resilience

• Backups (POL-SEC-004)? Encrypted, geographically redundant; tested recovery.
• Recovery objectives? RTO 4 h / RPO 2 h for critical services.
• Rebuild? Infrastructure-as-code for rapid reconstruction.
• DR testing? Annual DR simulation; incident-response tabletop exercises.

Physical & people security

• Physical security? All production runs in Hetzner’s certified EU data centres (provider-managed access control, logging, 24/7 security); no production servers on-premise.
• Personnel? NDAs mandatory for employees, subcontractors and temporary workers (POL-SEC-003); annual security-awareness training (phishing, GDPR, incident reporting). Formal background checks are not currently performed.
• Wireless? WPA2/WPA3; guest and corporate networks segregated; production reachable only via VPN.

Certifications & roadmap (transparency)