Every domain answered, including the ones where the answer is nothing.
A security reviewer's problem is rarely a vendor with gaps. It is a vendor whose document reads uniformly confident, so there is no way to tell which answers are load-bearing. This is organised by the 17 domains of the CSA Cloud Controls Matrix v4. Each row says where you can check it, and 6 say plainly that nothing is published.
This is not a completed CAIQ, and the difference matters
The Consensus Assessments Initiative Questionnaire is the Cloud Security Alliance's instrument. Presenting a document as a completed CAIQ would imply a formal self-assessment against that instrument, which has not been performed, and a reviewer would reasonably read it as one. The domain names below are a factual reference to a public framework, verified against cloudsecurityalliance.org, where CCM v4 is published as 197 control objectives across 17 domains. The answers are ours, and they map onto a CAIQ row by row if that is the format you need.
If your process requires the CSA instrument itself, send it and we will complete it.
Domains
17
Answered with evidence
9
Stated as not held
2
Nothing published
6
CSA Cloud Controls Matrix v4
Seventeen domains, seventeen answers.
Ordered as the Cloud Security Alliance publishes them. The evidence line is the part worth reading: it is where you check the answer without taking our word for it.
A&A Audit & Assurance
Not held
A SOC 2 report is issued by a licensed CPA firm, and an ISO/IEC 27001 or ISO/IEC 42001 certificate by an accredited certification body, each after its own audit; MetaMinds is neither of those bodies and issues neither document. What this firm operates instead is a twenty-one-gate pipeline that runs on every push to main and every pull request, and fails on any violation: type checking, linting, a secret scan across the working tree and full git history, metadata and claims verification, a one-source-of-truth check on every published price, a staleness check against our own 60-day rule, ratchets on the typographic and corner-radius scales, a test of the order and entitlement path, layout measurement across 62 routes and 24 device classes, contrast and Content Security Policy sweeps, a no-JavaScript and reduced-motion degradation suite, a WCAG 2.2 target-size check, per-route transferred-byte budgets, and Lighthouse thresholds. Deployment is a manual step, so the pipeline gates the code rather than automatically blocking a release. That is engineering assurance, not an attestation, and the two are not interchangeable.
Check itThe gate definitions are in .github/workflows/gates.yml and scripts/, and the chain itself is the `gates` script in package.json. The certification position is stated on /security.
AIS Application & Interface Security
Answered
The public site is prerendered: of 62 gated routes exactly two pages are server-rendered on demand, and both are dynamic only because they read query parameters, which is what lets the Article 50 tool return a verdict with JavaScript disabled. There are eleven route handlers, of which eight answer a request with logic and three serve generated text, and five runtime dependencies in total. Response headers set Strict-Transport-Security for two years, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Cross-Origin-Opener-Policy same-origin, and a Permissions-Policy denying camera, microphone, geolocation, display capture and payment among others. A Content-Security-Policy is ENFORCING, not report-only, with a reporting endpoint retained so that a blocked resource is reported as well as blocked.
Check itEvery header is observable with curl -I against any page, including whether the policy arrives as Content-Security-Policy or Content-Security-Policy-Report-Only. The policy and the CSP_ENFORCE flag that names the header are in apps/web/next.config.ts, and scripts/csp.cjs sweeps every route for violations.
BCR Business Continuity Mgmt & Op Resilience
Not published
No recovery time or recovery point objective is published for client engagements, and none should be inferred. The marketing site itself is statically prerendered and holds no client data, so its availability is not a client-data risk.
Nothing is published for this domain. Ask, and you will get a direct answer or an honest "we do not have that".
CCC Change Control & Configuration Management
Answered
Every change reaches production through version control and the gate pipeline; the production build fails on a TypeScript error rather than warning, because typescript.ignoreBuildErrors is set to false. Deployment to the application server smoke-boots a freshly built image in a throwaway container before the live one is replaced, so a configuration or startup failure aborts the deploy with the previous container still serving.
Check itapps/web/next.config.ts for the build setting; the deploy workflow for the smoke-boot-before-swap sequence.
CEK Cryptography, Encryption, & Key Management
Answered
Transport is HTTPS only, with HSTS set to two years. Encryption at rest for engagement data depends on the storage a client specifies, since retrieval can run inside the client's own tenancy; where it does, the client's keys and controls apply and we hold nothing. API credentials used by the site are server-side environment variables only, never exposed to the client bundle, and the site renders no assistant at all when its key is absent rather than shipping a broken one.
Check itHSTS is observable in response headers. The key handling rule is documented in CLAUDE.md section 4 and enforced by the secret-scan gate.
DCS Datacenter Security
Not applicable
MetaMinds operates no datacenter and owns no physical infrastructure. Physical and environmental controls are the responsibility of the named hosting subprocessors, whose own attestations should be assessed directly rather than through us.
Check itThe subprocessor list at /legal/subprocessors names each host and its region.
DSP Data Security & Privacy
Answered
Client data never trains any model. The smallest sample that answers the question is requested rather than a full corpus, and the corpus can remain in the client's own environment. Retention is the duration of the engagement, after which data is deleted, and deletion is a line item in the contract rather than a favour. Findings are not published or reused. A data processing addendum is signed as standard.
Check itStated on /security, with the processing terms at /legal/dpa and the retention and rights position at /legal/privacy.
GRC Governance, Risk Management, & Compliance
Answered
The governing rule is that every factual claim published must trace to evidence that exists today, enforced by a claims register with a row per number and named framework and a gate that fails the build when a page carries a claim the register does not support. Certifications not held are stated on the public site rather than omitted. This posture exists because a previous version of this site claimed SOC 2 compliance without holding an attestation.
Check itdocs/05-CLAIMS-REGISTER.md, the verify gate in scripts/verify.mjs, and the certification rows on /security.
HRS Human Resources Security
Not published
Access to client material is limited to named engineers on the engagement. Background screening, confidentiality agreements and security training are matters of record the owner holds; no policy document is published, and none should be assumed.
Check itThe access position is stated on /security. The remainder is not published.
IAM Identity & Access Management
Answered
Credentials issued to us are scoped to the engagement and revocable by the client at any time, and we ask for the narrowest scope that completes the work. The public site has no user accounts, no login and no session state, so it presents no authentication surface of its own.
Check itStated on /security; the absence of authentication is verifiable by inspection of the site.
IPY Interoperability & Portability
Answered
Deliverables belong to the client, including the parts we would rather not write. Systems are built on the client's own infrastructure and data where they choose, so there is no proprietary format or hosted dependency that has to be unwound to leave.
Check itStated on /security and in the engagement scope on /services.
IVS Infrastructure & Virtualization Security
Answered
Retrieval can run entirely inside the client's tenancy, which is the recommended arrangement for regulated data: the corpus does not move and the tenancy boundary is the client's own. Where work runs on our infrastructure instead, that infrastructure and its subprocessors are the ones named in the published list.
Check itStated on /security; hosting is enumerated at /legal/subprocessors.
LOG Logging & Monitoring
Not published
The site operates a Content-Security-Policy violation reporting endpoint during the report-only observation period. No security information and event management arrangement, log retention period or alerting commitment is published for client engagements, and none should be inferred.
Check itThe reporting endpoint is visible in the CSP header. Nothing further is published.
SEF Sec. Incident Mgmt, E-Disc & Cloud Forensics
Not published
A security.txt is published so a finder has a defined route to report a vulnerability. No incident response plan, notification timeline or forensic capability is published, and a buyer requiring a contractual breach-notification window should raise it directly.
Check it/.well-known/security.txt is served. Nothing further is published.
STA Supply Chain Mgmt, Transparency, & Accountability
Answered
Every subprocessor is published rather than supplied on request, each with the legal entity, the specific data it receives, its processing region, whether it is active or dormant, its privacy terms and the date it was first listed. Six are named. The application itself carries five runtime dependencies in total, which is a deliberate constraint on supply chain surface rather than an accident, and a secret scan runs over the working tree and the full git history on every push.
Check it/legal/subprocessors, apps/web/lib/subprocessors.ts, and the secret-scan gate.
TVM Threat & Vulnerability Management
Not published
Adversarial testing of AI systems is a service line here rather than a claim: prompt injection including injection arriving through retrieved documents, data exfiltration paths, and agent authority boundaries. That is what we do for clients. For our own estate, no internal vulnerability management policy, scanning cadence or remediation service level is published, and a buyer should ask rather than assume.
Check itThe service scope is described on /security and /assure. No internal policy is published.
UEM Universal Endpoint Management
Not published
No endpoint management, device encryption or mobile device management policy is published for the machines used to deliver engagements.
Nothing is published for this domain. Ask, and you will get a direct answer or an honest "we do not have that".
Questions
The procurement questions, answered directly.
Every answer here is the same string this page puts in its structured data, so a person and an answer engine read the identical text. Open one to read it.
Who issues a SOC 2 report, and what is the ISO/IEC 27001 credential here?
A SOC 2 Type II report is issued by a licensed CPA firm after its own observation window, which a client commissions directly. The ISO/IEC 27001 credential on the founder's list is a personal training certificate, held by one person and supplied on request; organizational certification to that standard is issued to a company by an accredited certification body after its own audit. This page keeps the two labelled, because they are routinely printed as though they were one.
Is this a completed CAIQ?
No, deliberately, and the distinction matters to a reviewer. The CAIQ is CSA's own instrument, its licence for reproduction could not be established, and a document presenting itself as a completed CAIQ would imply a formal self-assessment that nobody performed. What this is instead: an answer for each of the 17 domains of the CSA Cloud Controls Matrix v4, written in MetaMinds' own words, with a column saying where each answer can be checked without asking.
How many domains are actually answered?
Of 17 CCM v4 domains, 9 carry a substantive answer, 1 state that something is not held, 1 are not applicable to how this firm operates, and 6 say plainly that nothing is published yet. Those counts are deliberately not expressed as a score or a percentage, because the unpublished domains include incident response and endpoint management, which matter more to a regulated buyer than several of the answered ones. A coverage percentage would flatten that.
Why publish the gaps instead of leaving those rows out?
Because a security reviewer's real problem is not a vendor with gaps, it is a vendor whose document reads uniformly confident so they cannot tell which answers are load-bearing. Omitting a row removes the reviewer's ability to weigh it; stating that nothing is published for a domain tells them exactly where to push. The previous version of this company's site claimed SOC 2 compliance without an attestation, and this page is built the opposite way round on purpose.
Do MetaMinds or its model providers train on client data?
No. Client material is used to deliver the engagement and is not used to train models, and the subprocessor list published on this site names every third party that processes data from it, what each receives, and which are wired but switched off. Where a client requires a specific contractual commitment on this, it belongs in the data processing addendum, which MetaMinds publishes in full rather than sending on request.
Will MetaMinds sign our DPA and answer our own security questionnaire?
Yes to both. MetaMinds publishes its own data processing addendum, covering processor roles, security measures, the subprocessor list, breach notification within 24 hours and deletion at termination, and will sign a client's paper instead where that is the requirement. A client questionnaire gets answered directly, and where the honest answer to a question is that the control does not exist yet, that is the answer given rather than a form of words that reads like a yes.
How do I report a vulnerability in this site?
Through the contact published at https://metaminds.store/.well-known/security.txt, which is the RFC 9116 file for exactly this purpose. Reports are read by the person who wrote the code. MetaMinds' own background is offensive security, including vulnerability assessment and penetration testing across more than 50 government web assets delivered under public sector engagement rules, so a report describing a real issue gets a technical reply rather than a form response.
