Hybrid ELT Vendor Security Questionnaire: What Your CISO Will Ask, Answered

Hybrid ELT security reviews rarely stall on encryption or SSO. They stall on a question nobody has answered in writing: which data, credentials and metadata cross the vendor boundary, and where each one lands. A generic SaaS template can’t answer that, because it assumes the vendor runs the whole system and that a single SOC 2 report covers it. A hybrid tool splits the work between a vendor-run control plane and a data plane in your environment, so the defensible answer is a field-by-field list with evidence attached. The questionnaire below gives that list for each question a CISO will ask, with Airbyte Flex as the worked example.

Summary

• Hybrid ELT reviews depend on an exact list of the data, credentials and metadata that cross the vendor boundary.
• In Airbyte Flex, records stay in your data plane, which connects outbound over HTTPS and needs no inbound ports.
• Configuration, table and column names, cursor and primary-key values, and job status reach the control plane, which runs on GCP in the United States.
• Credentials entered in the UI pass through the control plane into your own secrets manager. Comparisons with other approved hybrid tools break down at this point.
• Attach Trust Center evidence and a written exit plan to the answers.

Try Airbyte Flex

What Is a Vendor Security Questionnaire?

A vendor security questionnaire is a structured set of questions a buyer sends a supplier to document its controls, policies and evidence before any data is shared or systems connected; it is one step in third-party risk management. NIST’s Cybersecurity Framework 2.0 calls for due diligence before a supplier relationship begins and ongoing supplier-risk monitoring, so assess the core control areas and hybrid deployment boundary when starting a record that remains open throughout the relationship.

Control Areas Every Vendor Security Questionnaire Covers

The major frameworks agree on the core topics. The CSA Cloud Controls Matrix v4.1 defines 207 controls across 17 domains, among them key management, identity and access, and business continuity. The Shared Assessments SIG adds supply chain and Nth-party management. A working questionnaire covers data protection and encryption, identity and access, incident response, business continuity and disaster recovery, subprocessors, and compliance evidence such as a SOC 2 report or an ISO 27001 certificate. Every one of those topics assumes the vendor runs one system in one place, and hybrid tools break that assumption first.

Why Hybrid ELT Security Reviews Get Stuck

Reviewers have reason to look hard at vendors. Third parties were involved in 48% of breaches in Verizon’s 2026 breach dataset, up from 30% the year before. A SaaS template asks “where is customer data stored?” and expects a single location. A hybrid tool splits responsibility between a control plane and data plane: the vendor runs the UI, APIs and orchestration, and syncs run in your environment. A reviewer who writes “customer environment” in that cell misses the metadata. A reviewer who writes “vendor” rejects a deployment that keeps records at home. Both mistakes come from forcing a two-part system into a one-part form, and hybrid deployment security depends on getting that split right.

How to Use the Hybrid ELT Questionnaire

The internal champion drafts the answers from current vendor documentation, and the vendor confirms them in writing. Each row should carry evidence: a documentation URL, a configuration excerpt, a firewall rule or a report. A bare “yes” proves nothing, and evidence lets the security team verify each answer without a call.

Set review depth by data access, not contract value. The CSF 2.0 implementation examples base supplier criticality on the sensitivity of the data a supplier handles and how much access it has to your systems. A replication tool holding production database credentials sits in the top tier however small the invoice. Start from a standard base, either the SIG’s Lite, Core and Detail tiers or the CAIQ v4.1 released January 2026, and append the hybrid section below.

The Questions Your CISO Will Ask About Hybrid ELT

Security reviewers move through a hybrid architecture from the network edge inward, and the question sets below follow that order. All Airbyte answers come from Airbyte’s hybrid deployment docs unless another link is given.

Network and Connectivity Questions

The first thing a reviewer wants to know is whether the vendor needs a path into the network. Every inbound vendor rule is a standing exception that someone has to monitor. A good answer names the direction, protocol, destination host and authentication method. In Flex, data planes send outbound HTTPS requests to the control plane at cloud.airbyte.com, authenticate with a data plane client ID and secret, and require no inbound requests. The docs name the host but publish no port list or IP ranges for data plane egress, so if your firewall allowlists by IP, get those addresses from Airbyte in writing.

The follow-up is private connectivity. AWS PrivateLink is optional. You expose the source or destination through a VPC endpoint service backed by a Network Load Balancer that you manage, add Airbyte’s AWS account as an allowed principal, and Airbyte creates the endpoint. Many Flex deployments don’t need it because the data plane already runs inside your network. The choice between PrivateLink and Flex depends on whether you need a private route to Airbyte-run syncs or need the syncs themselves running in your network.

Data Handling and Residency Questions

Residency rules attach to records, so reviewers ask where records are processed. A good answer separates records from metadata and lists every metadata item. Airbyte operates the control plane while the data plane, along with your records, credentials, keys, and compute, runs in your environment, though some metadata such as cursor and primary-key values sits in the control plane. Records are extracted, processed and loaded in your data plane. The docs list what reaches the control plane:

• Credentials entered in the UI, which are written to your secrets manager
• Connector configuration, table names and column names
• Cursor and primary-key values
• Job status, reported by the data plane
• Connector Builder test data during development and testing; published connectors sync in the workspace’s region
• Sync logs, only if you ask Airbyte to turn this on

Job logs and state stay in the data plane. Table and column names can themselves be sensitive in some schemas, so review them with the same care as values.

Where Hybrid ELT Metadata Is Stored

The control plane stores cursor and primary-key values wherever the data plane runs, and the data residency docs state that data you can’t send to the vendor-run control plane should not be used as a cursor or primary key. That turns cursor selection into a compliance decision. A timestamp cursor carries little personal data, while an email address used as a primary key sends personal data to the control plane. For multiple jurisdictions, you run one Flex instance with a separate workspace per region.

Credentials and Secrets Questions

Reviewers most often find surprises in credential handling. Authors of some older Airbyte articles add to the confusion by saying the control plane never handles credentials. The control plane writes credentials you enter in the UI to your secrets manager and reads them back when syncs run. Credentials are stored in your vault, but UI-entered values pass through the control plane to get there.

Flex data planes support AWS Secrets Manager, Google Secret Manager, Azure Key Vault and HashiCorp Vault. The control plane and data plane must use the same one, and data planes support access key authentication only. If your policy prohibits long-lived access keys, raise that at the start of the review.

Changing connector secret storage later causes existing connectors to fail, so settle the choice before the first connector goes live. Rotation needs work from your side: the docs publish no rotation procedure for the data plane client secret or for connector credentials, so your team writes that runbook. The patterns for external secrets management still apply.

Logging, Audit and Monitoring Questions

Audit logs answer “who changed what.” Job logs answer “what happened during a sync.” Audit log entries cover changes to workspaces, connections, connectors, users, permissions and settings. Each entry records the actor’s user ID, email address, IP address and user agent, along with request and response summaries with sensitive fields removed. Entries never contain the records your connections read or write, so audit logs show who changed the configuration, and sync activity has to be reviewed in the job logs.

Airbyte keeps them in the control plane for 365 days. You can’t redirect them to your own bucket, and the docs describe no export API, so plan a manual export if your retention policy runs past a year.

Job logs and state live in your data plane’s storage. From data plane Helm chart 2.1.0, components write structured JSON logs to stdout by default, and you collect them with your own DaemonSet collector, such as Fluent Bit or Vector. The Fluent Bit Kubernetes filter needs Buffer_Size 256k; without it, label enrichment can fail silently.

Compliance and Vendor Risk Questions

Data in transit uses TLS. For certifications, subprocessors and retention, the Airbyte Trust Center is the source of record. It lists current compliance reports, publishes a subprocessor list, and gives access to reports through a request flow. Answer certification questions with what the Trust Center lists and nothing more. Open source supplies evidence that an attestation can’t: Airbyte connectors are inspectable and forkable, so your engineers can read the code that touches your data.

Why a SOC 2 Report Doesn’t Answer Hybrid ELT Questions Alone

The strongest objection to a hybrid section is that the vendor already holds a SOC 2 Type II report, in which an auditor tested controls over a period. A questionnaire answer can’t match that. The argument is sound on how controls operate and weak on architecture. A SOC 2 report describes the system the auditor scoped, and a hybrid vendor’s system covers its control plane, while your data plane runs on infrastructure the vendor never operates. Under a carve-out, a subservice organization’s controls fall outside the report. The complementary user entity controls section lists what you must run yourself, which in a hybrid deployment includes the secrets manager, the cluster and log collection. For a fully managed tool whose system description matches what you are buying, a SOC 2 report can be enough. For a hybrid tool, it confirms that control-plane controls operate, and the questionnaire establishes the data path.

Using an Already Approved Hybrid Tool as Precedent

If your security team has already approved a hybrid orchestrator, the reasoning behind that approval carries over to the network and execution questions. Prefect workers poll over outbound-only connections with no inbound access to your network. They execute workflows locally, and Prefect receives only logs and state updates. Flex follows the same pattern: an outbound-only component in your environment, a vendor-run control plane, and records that stay home, though some metadata such as cursor and primary-key values sits in the control plane. The precedent covers only Prefect’s worker model, not its managed execution option.

The comparison weakens on metadata and fails on credentials. Prefect Cloud stores flow parameter values and workflow logs (logs can be disabled), and Airbyte’s control plane stores cursor and primary-key values. In both cases some values reach the vendor, not only names. On secrets, Prefect’s security page lists secrets and credentials among the data Prefect Cloud never accesses, whereas Airbyte’s control plane writes UI-entered credentials to your secrets manager and reads them back. Carry the network and execution findings forward and run the credential questions again from scratch.

The Full Vendor Security Questionnaire for Hybrid ELT

Copy these rows into your internal review and attach the listed evidence:

Once each row carries its evidence, the remaining step is turning those answers into a scored decision.

Scoring Vendor Responses and Reassessing Vendors

Approval needs risk-based scoring, ongoing monitoring and an exit plan covering credential revocation, data plane teardown and proof of metadata deletion.

Set stop rules before the vendor replies, so a high documentation score can’t average away a failed critical control. Shared Assessments’ approach rates inherent risk before evaluating controls and then scores residual risk. Add weights on top, but fail the review outright if the vendor requires inbound access, can’t list control-plane metadata in writing, or stores your credentials without giving you a choice of vault.

US banking regulators’ interagency guidance matches monitoring frequency to risk and calls for closer monitoring of relationships that support critical activities, which is where a tool holding production database credentials belongs. The same guidance lists security breaches and data loss, service interruptions and financial deterioration as escalation events. The EBA outsourcing guidelines add ownership changes and sub-outsourcing. For hybrid ELT, also trigger a reassessment when a subprocessor is added on the Trust Center or the documented list of what reaches the control plane changes.

Vendor Exit Questions for Hybrid ELT

Offboarding terms cost least to negotiate before signature. NIST SP 800-161 Rev. 1 recommends contracts that require suppliers to return access credentials immediately and that set termination terms, such as removing data from cloud environments. For Flex, start with credential revocation. The Airbox setup guide says rotating client credentials requires deleting the application in Airbyte, so deletion is the documented way to retire them. Then revoke the database users and API keys held in your vault. Data plane teardown is your job, because the cluster, buckets, logs and state belong to you. For control-plane metadata, request written deletion confirmation covering configuration and cursor values. For media sanitization, request a certificate documenting the method, tools and verification in the format NIST SP 800-88 Rev. 2 provides.

Shortening Your Next Security Review

The fastest reviews start with the champion sending the filled-in table and its evidence before the security team sends its own template. Once the metadata list, credential path and exit plan are written down, the team’s job is to confirm answers it already has. The same boundary covers data replicated for AI applications: records that feed an AI workload stay in your data plane under the same access controls, and the hybrid deployment architecture applies to them unchanged.

Get a demo to see how Airbyte keeps records and credentials inside your infrastructure boundary during a security review.

FAQ

Review depth depends on the tool’s data access, the evidence behind its answers and how its controls change over time.

What should a vendor security questionnaire for a data integration tool include?

Start with a standard base for general controls. Then add one question for every point where data, credentials or metadata cross into vendor infrastructure, plus exit terms. Every answer should name a location and attach evidence.

How do you verify answers with a SOC 2 Type II report?

Check that the report period ended recently and that the system description names the components you will actually run. If the period closed months ago, ask for the vendor’s unaudited bridge letter covering material control changes since then.

What is the difference between a vendor security risk assessment and due diligence?

Due diligence is the evidence you gather before signing. A risk assessment rates inherent and residual risk and is repeated for as long as the relationship runs, using new evidence each time.

Should you use SIG, CAIQ or a custom questionnaire?

CAIQ maps directly to cloud controls and suits the vendor’s SaaS control plane. SIG covers broader risk domains. The SIG FAQ prohibits editing its questions without permission but allows custom questions to be added, so append hybrid questions rather than rewriting the base.

How often should you reassess a hybrid ELT vendor?

Reassess top-tier vendors whenever release notes change the data path. Airbyte 2.1, for example, changed data plane log format defaults.

What extra questions apply when a tool holds database credentials?

Ask whether the replication user can be read-only, which privileges CDC requires, whether those credentials are entered through the vendor UI or written directly to your vault, and who can view them after storage.