What we learned answering 603 cloud security questions as a one-person company

What the CAIQ is

The Consensus Assessments Initiative Questionnaire (CAIQ) is a list of yes-or-no questions from the Cloud Security Alliance (CSA). Each question maps to a control in CSA's Cloud Controls Matrix: access management, encryption, logging, incident response, supplier management and so on. Buyers send it during security reviews because it saves them writing their own.

CSA also runs the STAR Registry, a public list of these answers. Level 1 is a self-assessment: the vendor answers the CAIQ and CSA publishes it after a review. Level 2 adds an independent third-party audit. There is now an AI-CAIQ too, built on CSA's AI Controls Matrix, which asks who is responsible for each control across the AI supply chain: the cloud provider, the model provider, the application provider and the customer.

Our answers in numbers

We answered the CAIQ v4.1 for Bastion Helix for Jira and the AI-CAIQ v1.1 for Agent Lens, where we are the application provider and Cloudflare is the cloud provider.

Most of the Agent Lens “not applicable” answers are about training and hosting AI models. We do neither, so whole sections of the AI-CAIQ don't apply.

1. Write the policy first, then answer

Many CAIQ questions ask whether a policy exists, is approved and is reviewed. You can't answer those honestly without one. We wrote our Information Security Policy first: twenty short sections covering risk, access, keys, change, logging, incidents, continuity, suppliers, devices and AI. It describes what we actually do at our size and commits us only to what we can keep doing. Then every answer could point to a section. The policy is public, so a reviewer can check.

2. No is an answer

A wall of Yes from a one-person company would not be believable, and it wouldn't help a buyer. Some controls are impossible at our size: separation of duties needs at least two people. Others we haven't done yet: no independent penetration test, no automated anomaly detection on logs. Each No says why and, where it applies, what is planned. A reviewer can see the real gaps and decide whether they matter for their use.

3. Every control has an owner, even “not applicable”

We run no servers. Atlassian hosts the Jira app; Cloudflare runs Agent Lens. So many controls belong to them, some to us, and some to the customer. The CAIQ makes you say which, row by row, and gives a column for what the customer must do themselves. One practical detail: CSA's checker rejected our first upload because rows marked “not applicable” had no owner. Even an N/A row needs one.

4. Check the answers against the code

We checked claims against the source before writing them down. That found things. Agent Lens API keys are generated from 32 random bytes, so that answer became a confident Yes. But we also found that in the Jira app, regenerating a GitHub source keeps its webhook signing secret, so a customer can't replace that secret on their own yet. The question on revoking compromised keys is answered No until the fix ships. A questionnaire is a cheap audit if you let it be one.

5. Submit from your own domain

CSA rejected our first submissions because they came from a Gmail address. The Registry only accepts entries from an email on the organisation's own domain. The fix cost nothing: Cloudflare Email Routing forwards support@ and security@ on our domain to our existing inbox, and we resubmitted from those the same evening.

Where it stands

Both self-assessments were submitted to the CSA STAR Registry on 20 October 2026. The Agent Lens AI-CAIQ was accepted the same night and is listed in the Registry as a STAR for AI Level 1 self-assessment. The Jira CAIQ is still waiting for CSA's review; until it is listed, its answers are available from security@bastionhelix.com. Both are self-assessments, not audits, and we say so. Our security page keeps the current status.

Questions

Is CSA STAR Level 1 a certification?

No. Level 1 is a self-assessment that CSA reviews and publishes. Independent audits are Level 2.

What is the difference between the CAIQ and the AI-CAIQ?

The CAIQ covers cloud security controls from the Cloud Controls Matrix. The AI-CAIQ covers the AI Controls Matrix and asks which party in the AI supply chain owns each control: cloud provider, model provider, orchestrated service provider, application provider or AI customer.

Can a one-person company answer the CAIQ honestly?

Yes. Answer from a written policy, check claims against the code, and answer No where a control isn't in place, with the reason. Buyers can then judge the real gaps.