Vendor security program
Formless Logic maintains a vendor security program for EntryLayer that covers secure development, vulnerability management, release review, access control, incident response, vendor management, and Snowflake Marketplace security evidence.
Program controls
The program is designed around EntryLayer's current operating model as a Snowflake Native App provider. It emphasizes reviewed changes, evidence capture, least-privilege access, dependency and package review, and protection of the zero-access product boundary.
Product changes are developed through branch-based work, code review, CI checks, automated tests, build validation, and focused security review for changes that affect auth, telemetry, package behavior, or customer data boundaries.
Dependency audit, static analysis, container scan evidence, and package-review evidence are maintained as part of Marketplace readiness and release review.
Submission candidate API and web container images are built from reviewed Dockerfiles, scanned for malware before Marketplace submission, and retained with private scan logs for reviewer evidence.
Repository, package, provider account, deployment, support, and review evidence access are managed with least-privilege intent and limited to people who need access for product, support, or Marketplace operations.
Release candidates are tracked by git SHA, CI run, package version, patch, deploy evidence, and Marketplace package review state where applicable.
Security and support incidents follow published intake, severity, acknowledgment, communication, containment, and post-incident review practices.
Security review focuses on maintaining the Snowflake Native App zero-access posture: no provider-hosted customer source-data store and no provider-owned external API egress for normal product behavior.
Review evidence
Evidence is maintained as internal review material and shared with Snowflake or customers when appropriate for security review, support, or Marketplace approval.
Pull requests, CI runs, test results, package version, patch, deploy run, and release directive outputs.
Manifest, setup SQL, service spec, container image references, source-map review location, and Snowflake package validation results.
Web/API dependency audit, static analysis, container vulnerability scan output, container malware scan output, and remediation tracking for actionable findings.
SPCS service status, endpoint review, application package review status, and customer-account runtime boundary documentation.
Incident response process, support contact, Marketplace case references, and customer notification record when applicable.
Vendor management
EntryLayer relies on a small set of operational providers. The product trust boundary is anchored in Snowflake, while support and development tooling are managed according to the access and data they handle.
Security operations
Current limitations
Related security pages
Data boundary
Normal product use does not require Formless Logic to operate a provider-hosted customer source-data store. The security program therefore focuses on the reviewed package, code, dependencies, release evidence, support systems, and the limited metadata paths described in the architecture documentation.
Questionnaire answer
For security questionnaires, EntryLayer can answer that Formless Logic maintains a vendor security program for EntryLayer appropriate to its current Snowflake Native App scope.
https://entrylayer.ai/security/vendor-security-program
