Our security questionnaire, filled in up front
Here are 44 answers to what IT asks a supplier about Contember Fabrika, from hosting and sign-in to exit. Each one says whether it's in place today or still to be agreed with you.
The spreadsheet has one row per answer, so you can paste it into your supplier file and filter by status. Link to a single answer by its ID, for example #c2. The exact commitments are in the contract.
Updated 8 November 2026
Czech version (XLSX)
What does IT ask when vetting a supplier?
The questions come from typical supplier questionnaires and from what IT asks us on calls.
What the status means
- In place today
- Agreed with you
- Set in the contract
- Per your infrastructure
- In progress
- Not available
A Architecture and hosting 9 questions
Where do the apps run?
In your own installation of the Fabrika platform, in a cloud account in your company's name, usually on Zerops. The apps' database, background jobs, e-mail and files run there too. If you need to stay in AWS, we set up the installation there.
Do you share the installation with other customers?
No. Each company has its own installation and shares it with no one.
Can Fabrika run on AWS?
Yes, on request. The platform code has no AWS provider, so we set up the installation in an AWS account in your company's name as part of the setup, in a region that meets your requirements. Otherwise company apps run on Zerops.
Can we run Fabrika on our own servers, on Azure or with another provider?
No. Company apps run on Zerops, or on AWS on request. The platform itself can also run on Cloudflare, but apps with a database, jobs or e-mail don't run there yet.
Can the apps be reached from the internet?
Not directly. The apps have no public address of their own, and every request goes through one platform entry point that lets in only verified users; when access rules are missing or unclear, it stays shut. Responses carry security headers including HSTS, sign-in and public forms are rate-limited (on Zerops a public form also gets its own bot challenge, with no third-party CAPTCHA), and an app can call out only to addresses it has declared.
Are testing and production separated?
Yes. Each environment is its own namespace with its own services, so testing can't touch production data. On the smallest size, apps in one environment may share a PostgreSQL service, each with its own schema.
Where are the apps' keys and passwords stored?
With the cloud provider, not in our database. Each app sees only its own, and through the platform they can be written but never read back.
How are errors and outages monitored?
Errors from all apps are collected in one place, grouped, and can be assigned and resolved. The platform checks that apps respond and alerts on a new error or a sudden spike.
B Data and where it lives 5 questions
Where does the data physically live?
In your cloud account. Usually on Zerops, a Czech company (Zerops s.r.o., Prague) with a data centre in Prague. On request on AWS, a US company, in a region that meets your requirements.
Will the data stay in the EU?
On Zerops, yes: it sits in Prague. On AWS, we pick the region to match your requirements. We don't promise EU location on Cloudflare, but app data doesn't run there yet.
What if a foreign authority requests the data? What about the US CLOUD Act?
Zerops is a Czech company, AWS a US one. What that means for authorities' access to your data, we're glad to go through with your lawyer.
What is our relationship with the cloud provider, and what is your role?
You deal with the provider directly: the cloud account is registered to your company, including the provider's data processing terms. Our access to your data and its scope are set out in our contract with you.
Our app runs on Supabase. What happens to the data in a takeover?
We decide it together: the data moves to a database in your cloud account, you run Supabase in your own account, or it stays where it is. Each option means a different place for the data.
C Sign-in and access 8 questions
How do users sign in?
With their company account through your identity provider over OIDC (for example Microsoft Entra ID, Google Workspace or Okta), one per installation, with one sign-in for all apps. Anyone without a company account, an outside contractor for example, uses a password that no admin can set or read.
What about multi-factor authentication (MFA) with a company account?
It works the way your company has it set up at your identity provider, which the sign-in goes through.
And with password sign-in?
In progress. Until then, we recommend giving a company account to everyone who can have one.
How are permissions set?
By role, per app. The app declares which roles it knows, you decide who gets which, and a new version won't overwrite the permissions you set.
How is access removed when someone leaves or changes roles?
Block the company account at your identity provider and, since there's no SCIM sync yet, in Fabrika's sign-in service (IAM) too. That ends the access the person already has. Roles in individual apps are changed or removed in the platform.
Who on your side has access to production?
We do, to the extent needed for change review, deployment and patches; exactly who, we agree during setup. Sign-ins and access changes are recorded, and access to the cloud account itself stays with you.
Are sign-ins and access changes recorded?
Yes, in an audit log you can see in the console. Every deployment also has its own record with a log: which version, when, and how it went.
How long are the records kept?
Records of access and role changes are kept, and we set the retention to your requirements. As a setting in the platform, this is in progress.
D Changes and development 5 questions
How does a change get into production?
Your person builds with AI, the change goes to Git with an author, time and description, and we review it before deployment. Once live it leaves a record, and you get a report on what changed, what we checked and how it came out.
Are changes reviewed by a person or a tool?
A person on our side, for every change before deployment: permissions, data handling and anything that could open access that should stay closed. Nothing reaches production any other way, and a deploy that widens access also waits for a person to approve it in the console.
Where is the source code, and who owns it?
In Git, and it's yours. Every change has an author, a time and a description; nothing is copied onto the server by hand.
Who can build apps?
Your person with AI, your developer or agency, or us with your person during a kickstart. Everyone goes through Git, the platform's rules and our review.
Will you take over an app built elsewhere, say in Lovable, Cursor or by a freelancer?
Yes, if it's code that can run outside the tool it was made in. We make small changes and deploy it into your account. Apps clicked together in Bubble and similar builders we can't take over.
E Operations, incidents and backups 5 questions
How do you handle backups and recovery?
We set them up with you as our service; the platform doesn't do it on its own. During setup we agree what gets backed up, how often, how long it's kept and how quickly the data has to be back.
What happens during an incident?
The platform alerts on a new error or a sudden spike. We help find out what happened in the app, fix it, and put together the documents for the report you have to file.
How soon do you tell us about an incident on your side?
The deadline is set in the contract.
What SLA do you offer?
Operations and change review come with an SLA. The level and the exact commitments are set in the contract.
Who fixes bugs in the apps when the code was written by our developer or agency?
We do, within the SLA.
F AI 4 questions
Which AI do you use, and on whose account?
The one you choose, always on your own plan and under your terms. We're happy to advise on picking the provider.
Does the AI work with production data?
No. Building happens on your person's computer from the brief and the code, the production database sits in a private network and the apps have no public address. The AI only gets data if someone deliberately gives it some.
Is anything trained on our data?
Not by us. What the AI provider may do with data is set by the terms of your plan.
Can the AI deploy a change on its own?
No. It goes the same way as any other change: through Git and our review. A deploy that widens access is also held by the platform until a person approves it; no machine key can.
G Suppliers and contract 6 questions
Who are your subcontractors?
For Fabrika you have one supplier: us. The cloud account with Zerops, or AWS, is in your company's name and the AI runs on your own plan, so we resell neither.
Who is our contract with when our agency builds the apps?
With us, directly. You hire the developer or agency yourself.
Do you have ISO 27001 or SOC 2 certification?
The platform runs on infrastructure you choose, in an account that is yours, so certifying that infrastructure is up to its operator. Zerops, the default operator, states on zerops.io that it is ISO 27001 certified, GDPR and DPA compliant. On AWS, you check its certifications with AWS directly. What the platform handles, how change review works and who has access to what, we go through with your IT on a technical call.
Do you run penetration tests?
You choose the infrastructure and it's your account; its security and certification are up to its operator. In your installation, the platform relies on a single entry point that lets in only verified users, and on a person reviewing every change before deployment. The installation is in your account and the platform's code is public on GitHub (MIT), so your own tester can examine it too.
Can you provide a software bill of materials (SBOM)?
Not yet. The apps' code is in your own Git, and the platform is open source (MIT), so its code and dependencies are public on GitHub.
Will you accept our security requirements for suppliers, for example under Annex 2 of Czech Decree 410/2025?
Send them to us in advance. We go through them with you before signing and tell you plainly what we can meet and what we can't.
H Exit 2 questions
What if we part ways?
The code is yours, the data and domains are in your account and the platform is open source (MIT), so the system keeps running and the next person picks it up from Git. Only our change review and support stop.
Do we have to pull our data out of your systems when we leave?
No. The data sits in your cloud account from day one, so nothing has to move.
What's missing here, and what do we do about it?
The questions we can't answer with a plain yes today, and what we offer instead.
Certifications and penetration tests
The platform runs on infrastructure you choose, in your own account, so certifying it is up to its operator. Zerops, the default, states on zerops.io that it is ISO 27001 certified, GDPR and DPA compliant. The platform itself we walk your IT through on a technical call.
#g3SBOM
The apps' code is in your own Git, and the platform's code and dependencies are public on GitHub (MIT).
#g5MFA with password sign-in
With a company account, MFA follows your identity provider. Until then, give a company account to everyone who can have one.
#c3How long records are kept
Records of access and role changes are kept. Tell us the retention you need during setup.
#c8Data with US providers and US law
Apps run on Zerops, a Czech company with a data centre in Prague. AWS and Cloudflare (where the platform can run, but app data doesn't yet) are US companies; the legal side we go through with your lawyer.
#b2Incident deadlines and SLA figures
How soon we tell you about an incident on our side, and the service level, are set in the contract, not on the website.
#e3When is Fabrika not for you?
-
Your rules require the supplier itself, not only the infrastructure, to hold a certification or a penetration test report before signing.
-
The apps have to run on your own servers, on Azure or with another provider. Fabrika runs apps on Zerops and, on request, on AWS.
What people ask about the questionnaire
Do the answers apply to our installation?
Yes, they describe how Fabrika works for every company. Where something is decided with you (cloud provider, backups, our access, record retention), the answer says so and we set it during setup.
Is this enough for NIS2?
It covers the supplier part: change management, exit and who has access. Whether the Czech Cyber Security Act applies to you is for your lawyer or auditor; this isn't legal advice. More on the NIS2 page.
Send us your questionnaire, we'll fill it in.
Your own template, SIG, CAIQ or your auditor's checklist: send it over, or go through it with our engineer in half an hour.