Document: Vendor Security Questionnaire Pack (common Q&A)
Product: AskMike.AI (askmike.tools) — multi-tenant B2B analytics / CRM / collections with AI assist
Company: AskMike.AI, an MCubed company
Security / incident contact: info@mcubedbi.net
Stack (stated): Vercel + Neon Postgres + OpenAI API (assumed for AI Features)
No fake certifications
1. Company & product
| Q | Answer |
|---|---|
| Legal / trading name | AskMike.AI, an MCubed company |
| Product URL | askmike.tools |
| Primary contact | info@mcubedbi.net |
| Product type | Multi-tenant B2B SaaS (analytics, CRM, collections, AI assist) |
| Hosting model | Cloud SaaS (Provider-hosted); no Customer-managed on-prem appliance |
2. Encryption
| Q | Answer |
|---|---|
| Data in transit | TLS for HTTPS access to the Services (as terminated/managed by hosting/CDN edge — Vercel). |
| Data at rest | Application data stored in Neon Postgres; encryption at rest relies on Neon’s platform capabilities. |
| Key management | Managed by infrastructure Subprocessors unless Customer-managed keys offered — Customer-managed keys: not claimed. |
| Secrets | Application secrets/env vars managed via hosting platform practices. |
3. Access control & authentication
| Q | Answer |
|---|---|
| Role-based access | Product supports tenant-scoped roles/permissions as implemented. |
| Privileged Provider access | Limited to personnel with need-to-know for support, operations, and security; access logged where tooling permits. |
| Customer admin controls | Customer admins manage Authorized Users within their tenant. |
4. Tenant isolation
| Q | Answer |
|---|---|
| Isolation model | Logical multi-tenant isolation in a shared application and shared database platform (Neon), with tenant scoping enforced in application queries/authorization. |
| Cross-tenant access | Not permitted by design; treated as a critical defect if discovered. |
| Dedicated instance / VPC | Not generally offered unless separately contracted. |
5. Application security & SDLC
| Q | Answer |
|---|---|
| Secure development | Reasonable secure coding practices for company stage; dependency updates. |
| Vulnerability management | Critical issues prioritized; contact info@mcubedbi.net for coordinated disclosure. |
| Pen test | Not claimed. |
| Bug bounty | Not claimed. |
6. Infrastructure & subprocessors
| Q | Answer |
|---|---|
| Primary hosting | Vercel (application hosting / edge) |
| Primary database | Neon (Postgres) |
| AI inference | OpenAI API (assumed) for AI Features |
| Subprocessor list | Published/maintained on the Subprocessors page; changes per DPA notice process |
| Data residency | Default processing may occur in the United States and Subprocessor regions |
7. Backups & availability
| Q | Answer |
|---|---|
| Backups | Database backups per Neon backup/PITR capabilities as configured. |
| RPO / RTO | Not formally published. |
| High availability | Relies on Subprocessor platform HA. No custom multi-region claim. |
8. Logging, monitoring & audit
| Q | Answer |
|---|---|
| Application / access logs | Security- and operations-relevant logging as implemented. |
| SIEM | Not claimed unless deployed. |
9. Incident response
| Q | Answer |
|---|---|
| IR contact | info@mcubedbi.net |
| Process | Provider investigates suspected Security Incidents, contains, remediates, and notifies affected Customers per DPA (target notice without undue delay where feasible). |
| Customer notification | Via account admin email and/or info@mcubedbi.net coordination |
| Breach history | No reportable Security Incidents involving Customer Personal Data to disclose as of this date. |
10. Employees, contractors & training
| Q | Answer |
|---|---|
| Confidentiality | Personnel with access bound by confidentiality obligations (employment/contractor agreements). |
| Device / endpoint | Reasonable device security for personnel with production access. Formal MDM is not claimed. |
| Least privilege | Production access limited by role; offboarding includes access revocation. |
11. Privacy & AI
| Q | Answer |
|---|---|
| Roles | Customer typically controller/business; Provider processor/service provider for Customer Data in the Services (see DPA). |
| Training of foundation models by Provider | Ask Mike does not claim to train foundation models on Customer Data. Third-party OpenAI API training/retention governed by OpenAI’s then-current API policies and org settings — see AI data processing. ZDR/MAM are not claimed. |
| Data subject requests | Customer handles end-user requests; Provider assists per DPA. |
| Subprocessor AI data flow | Prompts/context may leave the app DB to OpenAI when AI Features are used. |
12. Compliance & certifications
| Q | Answer |
|---|---|
| SOC 2 | None claimed. See Security certifications |
| ISO 27001 | None claimed. |
| HIPAA / BAA | Not claimed unless separately executed — default product not marketed as HIPAA |
| PCI DSS | Not claimed |
| GDPR readiness | DPA and Subprocessors pages describe processing and transfers; no certification implied |
13. Customer responsibilities (for questionnaires that ask)
Customer should: manage user access; use strong authentication; avoid submitting unnecessary sensitive data to AI prompts; configure integrations lawfully; export data before account closure if desired; report suspected account compromise to info@mcubedbi.net promptly.
Revision log
| Date | Author | Notes |
|---|---|---|
| Pack creation | Ask Mike | Initial version |
End of security questionnaire pack.