Security Checklist
Procurement and security review checklist for enterprise customers.
Platform scope#
- Hosting model — Freakout hosts the enterprise room experience. Customers embed rooms on their own website through an iframe.
- Primary region — Enterprise data is hosted on AWS Frankfurt (
eu-central-1) by default. Enterprise contracts can scope dedicated infrastructure in other supported AWS regions, multi-Availability Zone coverage, custom domains, and CDN edge/POP requirements. - Regional scope — Supported enterprise deployment scopes include Europe, Americas, and MENA, subject to contract and implementation review.
- Private assets — Product images, generated models, textures, and room media use private storage and signed URLs.
- Optional AI — AI provider calls happen only when a generation, assistant, voice, or realtime feature is enabled and used.
- Optional Shopify — Shopify data is processed only when a Shopify store is connected.
Security evidence package#
| Area | Current position | Evidence or contract item |
|---|---|---|
| ISO 27001 / SOC 2 | Not certified; stack is prepared for formal audit | Audit scope, auditor, target timeline |
| DPA | Standard DPA access and coverage are documented in Data Processing Addendum | Signed DPA, controller/processor roles, subprocessor terms |
| Subprocessors | Current provider list is documented in Compliance & GDPR | Provider locations, transfer mechanisms, notice period |
| Data residency | Primary hosting is AWS Frankfurt by default | Contract wording for requested region, Availability Zone coverage, custom domain, and CDN edge/POP requirements |
| Private asset storage | Enterprise private assets use private storage and signed URLs | Bucket policy, public-access-block policy, signed URL TTL |
| Storage access logs | Private asset storage events are logged separately | Log destination, lifecycle policy, retention evidence |
| Application audit logs | Security-relevant events are retained for 365 days | Audit event schema, export sample, lifecycle policy |
| Backup retention | MongoDB Atlas backup retention target is 24 hours | Backup policy, restore test evidence |
| RTO / RPO | Recovery targets are contract-specific | RTO, RPO, escalation owner |
| SLA and support | Support commitments are contract-specific | SLA, support hours, severity definitions, escalation path |
| Incident response | 72-hour breach notification commitment is included in enterprise DPA terms | Incident runbook summary, notification timeline |
| Admin access | Administrative actions are audit-logged and privileged access is reviewed | Access review evidence, privileged role list |
| AI processing | AI data flow is documented by feature | Provider terms, opt-in feature list, data categories, training/retention position |
Security questionnaire answers#
| Question | Answer |
|---|---|
| Does the customer host the storefront? | No. Freakout hosts the room experience; the customer embeds it through an iframe. |
| Are private assets public? | No. Enterprise private assets are served through signed URLs after authorization checks. |
| Are camera frames uploaded for hand or pose interactions? | No. Camera-driven interactions run in the visitor's browser. |
| Are AI features always on? | No. AI provider calls happen only when the relevant feature is enabled and used. |
| Do AI providers train on customer data? | Provider terms control this. OpenAI business/API, Google Gemini paid API, and Anthropic commercial terms restrict training use; Meshy requires vendor confirmation during enterprise review. |
| Is Shopify required? | No. Enterprise iframe embeds can run without Shopify. |
| Are payment cards stored by Freakout? | No. Stripe handles card data. |
| Are audit logs deleted with the account? | No. Audit logs remain for the fixed security-log retention window. |