Security questionnaire, answered.
The questions a vendor-security review asks — access control, encryption, incident response — with answers grounded in what the platform actually does, not aspirational policy language.
How to read this
These answers describe the product’s capabilities. They are a starting point for your own vendor review, not a certification. For the specific controls behind each answer, see the framework mappings linked below.
Access control
How is emergency access to sensitive credentials restricted?
Every secret is sealed with Shamir K-of-N. No single person — including a Break Glass administrator — can release it. A quorum of your own approvers must agree before the material is decrypted, and the threshold is enforced at the data layer, not by policy.
Can Break Glass staff read customer secrets?
No. Secret values are end-to-end encrypted before they reach the server. The server stores ciphertext and key shares it cannot combine on its own, so it is technically incapable of reading the plaintext.
How are joiners, movers, and leavers handled?
SSO via OIDC authenticates operators through your own IdP (Okta, Entra ID, Google Workspace, Ping). SCIM provisions and deprovisions accounts from your directory, so a leaver loses access to the break-glass vault automatically.
Are requester, approver, and administrator roles separated?
Yes. Roles are explicit and enforced per secret, with per-secret T-of-N thresholds. No single role can unilaterally unlock content.
Encryption
How is data encrypted at rest?
Secret material is encrypted client-side with envelope encryption before storage. Database and object storage are additionally encrypted at rest by the platform.
How is data encrypted in transit?
All traffic is TLS. Notification channels (SMS, email, voice) are delivered over the provider's encrypted transport.
What key management is used?
A master key wraps per-record data keys. Secret shares are distributed K-of-N so that no stored key alone recovers plaintext.
Incident response and resilience
Is there an audit trail?
Yes — an append-only log of every request, grant, approval, revoke, message, escalation, and policy change. It is exportable for a board, an auditor, or a supervisory authority.
How is emergency access tested?
Scheduled drills and tabletop exercises page the real call tree without releasing live secrets, and the results are recorded as evidence that the procedure works.
What happens when a responder is unreachable?
Escalation ladders retry on timeout across SMS, email, and voice with acknowledgement tracked, so a single unreachable person does not silence the alert.
See the control mappings for ISO 27001, SOC 2, DORA, NIS2, and Cyber Essentials, or the full trust overview.