# Security Review Pack: Answering Your Vendor Questionnaire

> Source: https://agilitycms.com/docs/owners-admins/security-review-pack

If you are completing a vendor security questionnaire about Agility CMS, such as a SIG, a CAIQ or your organization's own form, this page tells you where each common area is already answered. Every answer it points to is in a published Agility article or on an Agility security page, so you can quote the source directly.

Some details are not published and are shared on request, often under NDA. Those are listed below so you can ask for them early instead of finding the gap at the end of the review.

For a single summary of how sign-in, permissions, network access and logging work, read the [Security Review Guide](https://agilitycms.com/docs/owners-admins/security-review-guide) first.

## Start here

| Resource | What it gives you |
| --- | --- |
| [Agility Trust Center](https://trust.agilitycms.com) | Agility's compliance reports, security questionnaires and policy documentation. |
| [Agility security page](https://agilitycms.com/security) | An overview of security at Agility, with links to the Trust Center, system status and vulnerability reporting. |
| [Security Review Guide](https://agilitycms.com/docs/owners-admins/security-review-guide) | Every way into Agility, sign-in and permissions, network restrictions, audit and logging, and removing a user's access. |
| [Hosting, Security & Compliance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance) | Hosting, encryption, key management, the security program, identity and access controls, and which certifications are Agility's own versus the Azure platform's. |
| [The Agility Shared Responsibility Model](https://agilitycms.com/docs/owners-admins/shared-responsibility-model) | What Agility secures, what your team secures, and what is shared, in one set of tables. |
| [status.agilitycms.com](https://status.agilitycms.com) | Live platform status and incident history, with subscriptions to incident notifications. |

For certifications and attestations, including report dates and audit periods, get the current reports from the Trust Center or your account team, and quote those in your questionnaire.

## Questionnaire areas and where they are answered

| Questionnaire area | Where the answer is | What you will find |
| --- | --- | --- |
| Security governance and policies | [Hosting, Security & Compliance: Security program & governance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#security-program--governance) | The policy domains Agility's information security program covers, and that policy and control details are shared under NDA. |
| Compliance and attestations | [Trust Center](https://trust.agilitycms.com), [Hosting, Security & Compliance: Certifications and compliance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#certifications-and-compliance) | Agility's own attestation, how to request the report, and which certifications belong to Microsoft Azure. |
| Hosting and infrastructure | [Hosting, Security & Compliance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#hosting-and-infrastructure), [Content Delivery & CDN Architecture](https://agilitycms.com/docs/developers/content-delivery-and-cdn-architecture) | Hosting on Microsoft Azure, and the two CDN layers: Agility's platform CDN, which is Fastly, and your own front-end CDN. |
| Data location and residency | [Data Residency & Data Regions](https://agilitycms.com/docs/owners-admins/data-residency-and-data-regions) | The available regions, what is stored in the selected region, and why edge delivery is a separate, global layer. |
| Encryption and key management | [Hosting, Security & Compliance: Encryption](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#encryption) and [Key management](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#key-management) | Standards in transit and at rest, the managed key store, and BYOK availability. |
| Backup, disaster recovery and business continuity | [Disaster Recovery & Business Continuity](https://agilitycms.com/docs/owners-admins/disaster-recovery-and-business-continuity) | The backup model, multi-region recovery, failover, DR testing frequency, and what keeps serving during an incident. |
| Availability and SLA | [SLA & Uptime](https://agilitycms.com/docs/owners-admins/sla-and-uptime) | The difference between the delivery and management service levels, maintenance, service credits and status monitoring. |
| Authentication | [User Authentication](https://agilitycms.com/docs/owners-admins/user-authentication), [Enterprise Single Sign-On with Agility](https://agilitycms.com/docs/owners-admins/enterprise-sso-with-agility-cms), [SAML Identity Provider Integration](https://agilitycms.com/docs/owners-admins/saml-identity-provider-integration), [Authenticate with Microsoft or Azure AD/Entra](https://agilitycms.com/docs/owners-admins/authenticate-with-microsoft-or-azure-ad), [Multi-Factor Authentication](https://agilitycms.com/docs/owners-admins/multi-factor-authentication), [Password Management](https://agilitycms.com/docs/owners-admins/password-management) | Supported sign-in methods and identity providers, plan requirements, MFA enforcement and enrolment, and password reset. |
| Authorization and least privilege | [User Permissions](https://agilitycms.com/docs/owners-admins/user-permissions), [Roles and Permissions Matrix](https://agilitycms.com/docs/owners-admins/roles-and-permissions-matrix), [Custom Roles](https://agilitycms.com/docs/owners-admins/custom-roles), [Item-level Permissions](https://agilitycms.com/docs/owners-admins/item-level-permissions), [Teams](https://agilitycms.com/docs/owners-admins/teams) | Built-in roles, base permissions, Custom Roles, item-level security and team-based access. |
| Network access | [Security Review Guide: Network restrictions](https://agilitycms.com/docs/owners-admins/security-review-guide#network-restrictions) | What network restrictions are and are not available, and how to apply network policy through your identity provider. |
| User provisioning and deprovisioning | [User Lifecycle at Scale](https://agilitycms.com/docs/owners-admins/user-lifecycle-at-scale), [User Access](https://agilitycms.com/docs/owners-admins/user-access) | What is supported for adding, changing and removing access, and how to review it. |
| API and credential management | [Personal Access Tokens](https://agilitycms.com/docs/developers/personal-access-tokens), [API Key Management](https://agilitycms.com/docs/training-guide/admin-api-keys) | Token lifetime, scope and revocation; API key types, storage and regeneration. |
| Logging and monitoring | [Audit Trail, Logging & SIEM Integration](https://agilitycms.com/docs/owners-admins/audit-trail-logging-and-siem-integration), [Accessing Reports](https://agilitycms.com/docs/owners-admins/accessing-reports) | Version history, Recent Changes, User Activity, what is not logged for customers today, and how to forward events to a SIEM. |
| Integrations and webhooks | [Verifying Signed Webhooks](https://agilitycms.com/docs/developers/verifying-signed-webhooks), [Webhook Events and Payload Reference](https://agilitycms.com/docs/developers/webhook-events-and-payloads) | Signed deliveries, secret rotation, retries, delivery history and its retention. |
| AI and data handling | [What Happens to Your Data When You Use AI](https://agilitycms.com/docs/owners-admins/ai-and-your-data), [Governing AI Access to Agility CMS](https://agilitycms.com/docs/owners-admins/governing-ai-access) | How the Agility CMS MCP Server authenticates and is governed, and what data leaves Agility when people use AI. |
| Security testing | [Agility security page](https://agilitycms.com/security) | Third-party penetration testing, and the option for enterprise customers to collaborate on custom penetration testing. |
| Vulnerability disclosure | [Agility security page](https://agilitycms.com/security) | Where to report a vulnerability and what Agility asks of researchers. |
| Incident response and notification | [Hosting, Security & Compliance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#security-program--governance), [Disaster Recovery & Business Continuity](https://agilitycms.com/docs/owners-admins/disaster-recovery-and-business-continuity#failover-and-restore-process), [Agility security page](https://agilitycms.com/security) | That a defined incident process exists, how affected customers are notified, and where to report an incident. |
| Privacy and GDPR | [Agility GDPR page](https://agilitycms.com/gdpr), [Privacy Policy](https://agilitycms.com/privacy-policy) | Agility's data protection commitments and how to make a data request. |
| Contract terms | [Agility Customer Agreement](https://agilitycms.com/customer-agreement) | The agreement that governs the service. SLA figures and service credits are part of each customer's agreement. |
| Your own responsibilities | [The Agility Shared Responsibility Model](https://agilitycms.com/docs/owners-admins/shared-responsibility-model), [Admin Go-Live Checklist](https://agilitycms.com/docs/owners-admins/admin-go-live-checklist) | What your team must secure and configure, so your answers cover both sides. |

## Shared on request

The published articles say these details are available on request, including under NDA as part of a security review or RFP. Ask through [Contact Agility](https://agilitycms.com/contact-agility-cms):

- The SOC 2 report ([Hosting, Security & Compliance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#certifications-and-compliance)).
- The substance of individual security policies and control implementations ([Hosting, Security & Compliance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#security-program--governance)).
- Recovery time and recovery point objectives, secondary-region pairings and replication details ([Disaster Recovery & Business Continuity](https://agilitycms.com/docs/owners-admins/disaster-recovery-and-business-continuity#multi-region-disaster-recovery)).
- Backup retention and restore-time details, the DR runbook, activation criteria and the most recent DR test results ([Disaster Recovery & Business Continuity](https://agilitycms.com/docs/owners-admins/disaster-recovery-and-business-continuity#failover-and-restore-process)).
- SLA figures, maintenance-window notice periods and the service-credit schedule ([SLA & Uptime](https://agilitycms.com/docs/owners-admins/sla-and-uptime)).

## Answers reviewers often get wrong

These points come straight from the articles above. They are the ones most worth checking before you submit:

- **Agility's own attestation is not the same as Azure's certifications.** [Hosting, Security & Compliance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#certifications-and-compliance) separates the attestation Agility holds from the certifications of the Azure platform it builds on. Keep them apart in your answers.
- **There is no native SIEM connector.** Events reach a SIEM through a webhook handler that your team or partner builds ([Audit Trail, Logging & SIEM Integration](https://agilitycms.com/docs/owners-admins/audit-trail-logging-and-siem-integration#export-to-siem-azure-monitor-splunk-etc)).
- **There is no customer-facing administrative or security event log today.** Users added or removed, role changes and token creation are not exposed to customers; capture sign-in events in your identity provider ([Audit Trail, Logging & SIEM Integration](https://agilitycms.com/docs/owners-admins/audit-trail-logging-and-siem-integration#what-is-captured-today)).
- **IP allowlisting and private connectivity are not available.** Agility is a multi-tenant SaaS service reached over HTTPS on the public internet. Apply network policy through SSO and your identity provider ([Security Review Guide](https://agilitycms.com/docs/owners-admins/security-review-guide#network-restrictions)).
- **Customer-managed keys (BYOK) are not available at this time** ([Hosting, Security & Compliance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#key-management)).
- **Storage residency is not delivery residency.** Data at rest stays in the selected region, but published content is cached and served from edge locations worldwide, and that cannot be geographically restricted at this time ([Data Residency & Data Regions](https://agilitycms.com/docs/owners-admins/data-residency-and-data-regions#edge-delivery-is-a-separate-layer-not-bound-by-content-residency)).
- **Five-nines end-user availability is an architectural outcome, not a contractual guarantee.** The contracted targets are in the customer agreement ([SLA & Uptime](https://agilitycms.com/docs/owners-admins/sla-and-uptime)).
- **SSO authenticates; roles are assigned in Agility** ([Hosting, Security & Compliance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance#identity-access-and-operational-controls)).
- **Feature availability depends on plan.** Enterprise SSO, Teams and Custom Roles need an Enterprise plan; enforcing MFA and restricting sign-in methods need a Pro or Enterprise plan. Check the plan the questionnaire is about.

## Anything else

For questionnaire topics not covered in the documentation, such as subprocessors, a data processing agreement, data retention and deletion after a subscription ends, penetration test summaries or personnel security, contact your account team or [support@agilitycms.com](mailto:support@agilitycms.com). Record the answer and its date in your questionnaire.

## Related articles

- [Security Review Guide](https://agilitycms.com/docs/owners-admins/security-review-guide)
- [The Agility Shared Responsibility Model](https://agilitycms.com/docs/owners-admins/shared-responsibility-model)
- [Hosting, Security & Compliance](https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance)
- [What Happens to Your Data When You Use AI](https://agilitycms.com/docs/owners-admins/ai-and-your-data)
- [Admin Go-Live Checklist](https://agilitycms.com/docs/owners-admins/admin-go-live-checklist)
- [User Lifecycle at Scale](https://agilitycms.com/docs/owners-admins/user-lifecycle-at-scale)

---

## Related pages

- [The Agility Shared Responsibility Model](https://agilitycms.com/docs/owners-admins/shared-responsibility-model.md)
- [What Happens to Your Data When You Use AI with Agility](https://agilitycms.com/docs/owners-admins/ai-and-your-data.md)
- [Admin Go-Live Checklist](https://agilitycms.com/docs/owners-admins/admin-go-live-checklist.md)
- [User Lifecycle at Scale: Provisioning, Offboarding and Access Reviews](https://agilitycms.com/docs/owners-admins/user-lifecycle-at-scale.md)

Index of every docs page: https://agilitycms.com/docs/llms.txt