Provide comprehensive identification and connectivity details for the third-party SaaS service requesting integration access to production environments.
SaaS Service Name
Vendor Company Legal Name
Vendor Technical Contact Email
Service Category
Monitoring & Observability
CI/CD & DevOps Tools
Security & Identity Management
Customer Relationship Management
Payment Processing
Communication & Messaging
Analytics & Business Intelligence
Cloud Infrastructure
Other
Please describe the service category in detail:
Primary Production API Endpoint URL
Webhook Reception Endpoint URL (if applicable)
Does this integration require IP whitelisting on the vendor side?
Provide the complete list of IP ranges or CIDR blocks that must be whitelisted:
Primary Geographic Region of SaaS Service Deployment
North America
South America
Europe
Asia Pacific
Africa
Middle East
Global Distribution
Other
Service Maturity & Reliability Rating (based on vendor SLA history)
Upload Architecture Diagram showing data flow between SaaS and internal systems
Additional Endpoint Metadata & Technical Notes
Define the precise access permissions, data classification levels, and token privilege requirements necessary for this integration. This section directly impacts security posture and compliance boundaries.
Data Classification Level for Information Accessed by this Integration
Public - Non-sensitive data only
Internal - General business data
Confidential - Sensitive business data
Restricted - Highly sensitive or regulated data
I confirm that data at rest encryption is enabled for all data stored by this SaaS service
I confirm that enhanced security controls including field-level encryption are implemented
Specific API Scopes & Permissions Required (list each scope)
Authentication Token Type
OAuth 2.0 Bearer Token
API Key (Static)
JSON Web Token (JWT)
mTLS Client Certificate
AWS Signature v4
Other
OAuth 2.0 Flow Type
Authorization Code Flow
Client Credentials Flow
PKCE
Device Flow
Refresh Token Rotation
JWT Signing Algorithm
RS256 (RSA)
HS256 (HMAC)
ES256 (ECDSA)
EdDSA (Ed25519)
Token Expiration & Rotation Policy
No expiration (static API key)
30 days
90 days
180 days
365 days
Dynamic (JWT with custom expiration)
Will this token have administrative or super-user privileges?
Provide detailed business justification for requiring elevated privileges:
Will this integration access Personally Identifiable Information (PII)?
List all PII fields that will be accessed (e.g., email, phone, SSN):
I confirm that no PII, sensitive personal data, or regulated information will be accessed
Data Retention Period for Logs & Cached Data
7 days
30 days
90 days
180 days
365 days
Indefinite (must justify)
Data Residency & Sovereignty Requirements
No specific residency requirements
Data must remain in EU (GDPR)
Data must remain in specific country
Data must remain in specific region
Compliance Frameworks this Integration Must Adhere To
ISO 27001
SOC 2 Type II
GDPR
CCPA/CPRA
HIPAA
PCI DSS
FedRAMP
SOX
Other
Upload ISO 27001 certification or audit report
Upload SOC 2 Type II report
I confirm Data Processing Agreement (DPA) is signed with vendor
Specify cryptographic standards, transport security requirements, and authentication hardening measures to ensure secure communication channels.
Minimum Required TLS Version for All Connections
TLS 1.2
TLS 1.3 Only
Approved Cipher Suites for TLS 1.2
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES128-GCM-SHA256
Is Mutual TLS (mTLS) required for this integration?
Provide client certificate details, CN, and issuing CA information:
Primary Authentication Protocol
API Key in Header
API Key in Query Parameter
Bearer Token (OAuth)
JWT with Signature Verification
AWS Signature v4
mTLS Certificate
HMAC-SHA256 Signature
Other
Secret & Credential Rotation Frequency
30 days
90 days
180 days
365 days
On-demand (event-driven)
No rotation (static)
Is Certificate Pinning implemented for this integration?
Provide SHA-256 certificate fingerprint for pinning:
Webhook Signature Verification Method
HMAC-SHA256
HMAC-SHA512
RSA-SHA256
No signature verification
Other
HMAC Identifier
Has a recent security audit been completed for this integration?
Upload the security audit report
Planned audit completion date
Is vulnerability scanning enabled for this integration?
Has penetration testing been performed on this integration?
Define operational parameters for traffic management, reliability engineering, and business continuity to ensure system stability under load and during outages.
Expected Peak Requests Per Second (RPS) from this Integration
SaaS Provider's Rate Limit (requests per minute)
Rate Limit to be Enforced on Our Side (requests per minute)
Rate Limiting Strategy
Fixed Window Counter
Sliding Window Log
Token Bucket
Leaky Bucket
No rate limiting
Retry Policy for Failed Requests
Exponential Backoff (3 attempts)
Linear Backoff (5 attempts)
Immediate Retry (1 attempt)
No retries
Custom logic
Is a Circuit Breaker pattern implemented for this integration?
Describe circuit breaker threshold settings:
Primary Health Check Endpoint URL
Is a failover endpoint configured?
Failover Endpoint URL
Failover Strategy
Active-Passive (manual switch)
Active-Active (automatic)
Active-Active (load balanced)
No failover
24/7 Incident Response Contact Email
Incident Response SLA
15 minutes (Critical)
30 minutes (High)
1 hour (Medium)
4 hours (Low)
24 hours (Informational)
Is monitoring and alerting configured for this integration?
List alert channels and notification endpoints (e.g., PagerDuty, Slack, Email):
Downtime Communication & Escalation Plan
Is backup data synchronization enabled for disaster recovery?
Final authorization and risk acceptance by designated technical leadership and security governance. All production integrations require dual approval from both Architecture and Security functions.
Lead Solutions Architect Full Name
Lead Solutions Architect Corporate Email
Technical Risk Assessment Score (1=Low Risk, 5=Critical Risk)
Has a formal security review been completed by the Security Architecture team?
Scheduled Security Review Date
Compliance Verification Completed
Data Privacy Impact Assessment
Third-Party Risk Assessment
Vendor Security Questionnaire
SOC 2 Review
Penetration Test Review
None
Enterprise CISO Full Name
Enterprise CISO Corporate Email
Final Approval & Authorization Date
Has this integration been reviewed by the Architecture Review Board (ARB)?
ARB Review Meeting Date
Permanent Documentation Storage Location
Additional Security Controls or Compensating Measures Implemented
I acknowledge that I have read, understood, and accept all technical and security risks associated with this production integration. I authorize the issuance of production credentials and assume responsibility for ongoing compliance monitoring.
Enterprise CISO Digital Signature
To configure an element, select it on the form.