# Namecheap Security Review
# Classification: Confidential
# Date: 2026-06-09
# Reviewer: Claude Code (drafted); pending Founder approval
# Status: Draft

---

## 1. Vendor / Device Overview

| Field | Value |
|---|---|
| **Name** | Namecheap, Inc. |
| **Website** | namecheap.com |
| **Service / purpose** | Domain registrar (registrar-of-record). DNS is delegated to Azure DNS — Namecheap is registrar-only. |
| **CBB use case** | Registrar for CBB/ScopeDOPE domains (`scope-dope.com`, `coldboreballisticsllc.com`, `ballisticcomputer.com`, `ballisticscomputer.com`, others). API used for registrar operations only. |
| **Data tier(s) accessed** | Tier 2 (General) — domain registration / WHOIS contact data. No customer or product data. |
| **Access type** | API key (registrar API); account login |
| **Proposed onboarding date** | Already in production — retrospective review |

---

## 2. Data Exposure Assessment

### 2.1 What CBB data will this vendor / device access?

- Domain registration records and WHOIS contact data (CBB business registrant info; WHOIS privacy applies)
- Registrar-level nameserver delegation pointers (delegated to Azure DNS)
- Billing contact for renewals

No customer data, no ballistic/product data, no SPEC material. **Authoritative DNS records live in Azure DNS, not Namecheap** — so DNS zone contents (TXT/MX/SPF/DKIM/CNAME) are not held by Namecheap.

### 2.2 Where will CBB data be stored by this vendor?

On Namecheap's infrastructure (registration records, account profile, payment method token). Namecheap has appointed EDPO as its GDPR Article 27 EU representative and publishes a Data Processing Addendum.

### 2.3 Is any Highly Confidential data (Tier 4) involved?

- [ ] Yes
- [x] **No** — registrar data only.

---

## 3. Vendor Security Posture (Software vendors only)

### 3.1 Compliance and certifications

| Standard | Certified? | Notes |
|---|---|---|
| SOC 2 | Reported compliant | Per public vendor-risk profiles; reviewer to confirm report availability directly |
| ISO 27001 | Reported compliant | Per public vendor-risk profiles; confirm certificate at approval |
| GDPR compliant | Yes | EDPO appointed as Art. 27 representative; DPA + SCCs published on legal pages |
| CCPA compliant | Reported | Confirm in current privacy policy |

> **Caveat:** Namecheap does not publish a formal Trust Center the way Twilio/Atlassian do. The SOC 2 / ISO 27001 claims above come from third-party vendor-risk aggregators, not a first-party certificate page. **Reviewer must verify directly with Namecheap (support request) before sign-off** — treat as unconfirmed until then.

### 3.2 Data processing agreement

- [x] A Data Processing Addendum is published on Namecheap's legal pages
- [ ] Not available

### 3.3 Breach history

No publicly disclosed material breach of registrar account data in the past 3 years known at drafting (a 2022 phishing campaign *impersonated* Namecheap via a third-party email provider but was not a breach of Namecheap systems). Reviewer to re-check at approval.

### 3.4 Security documentation

- [ ] Formal Trust Center / SOC 2 page — **not published first-party** (see caveat §3.1)
- [x] Privacy policy + DPA published
- [x] 2FA available on account

### 3.5 Authentication and access control

- [x] MFA / 2FA supported — **confirm enabled on the CBB account**
- [ ] SSO / SAML — not applicable / not offered at this tier
- [x] API key scoping — registrar API key with IP allowlist capability
- [ ] OAuth — registrar API uses API key + client IP allowlist, not OAuth

---

## 4. Hardware Security Assessment

**N/A** — software/SaaS vendor.

---

## 5. Integration Security

### 5.1 Credential management

- [x] API key → `kv-cbb-shared-prod` → `namecheap-api-key`
- [x] Key stored in Key Vault, never in code/config
- [x] Registrar API enforces a client-IP allowlist (defense in depth beyond the key)
- [ ] **Account password:** pending migration from personal 1Password to CBB 1Password vault (per Acquisition Brief). Break-glass only — automation uses the Key Vault API key. **Recommend completing the password migration** so no CBB credential lives in a personal store.

> **Note (CLAUDE.md):** `namecheap_dns.sh` is registrar-era tooling — DNS is now delegated to Azure DNS (`cbb-infra/services/dns`). Do not use the DNS publish path for ongoing DNS; multi-value TXT hazard applies if ever used. Registrar API use is limited to registrar operations.

### 5.2 Network exposure

Outbound registrar API calls from an allowlisted operator IP. No inbound firewall rule or public IP on CBB infrastructure.

### 5.3 Offboarding plan

Revoke: delete `namecheap-api-key` from Key Vault, remove API IP allowlist, transfer domains to a new registrar (auth/EPP codes), or transfer account. For a ScopeDOPE-only sale, transfer `scope-dope.com` (and trademark-placeholder domains as negotiated) to the buyer's registrar; CBB Corporate domains stay.

---

## 6. Risk Summary

| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Domain hijack via registrar account compromise | L | H | 2FA on account; registrar-lock enabled; API key in Key Vault + IP allowlist |
| CBB credential in personal password store (account pwd) | M | M | Complete migration to CBB 1Password vault; break-glass only; API path unaffected |
| Unverified SOC 2/ISO posture | M | L | Verify directly with Namecheap before sign-off; registrar-only, no product data at stake |
| WHOIS contact data exposure | L | L | WHOIS privacy enabled; business registrant info only |

**Overall risk rating:** **Low–Medium** (domain-hijack impact is high; mitigations reduce likelihood to low).

**Recommendation:** **Approve with conditions** — pending Founder sign-off.

**Conditions:**
1. Verify SOC 2 / ISO 27001 status directly with Namecheap (the §3.1 claims are third-party-sourced and unconfirmed).
2. Confirm 2FA enabled and registrar-lock on all domains.
3. Complete account-password migration from personal 1Password to CBB 1Password vault.
4. Confirm API IP allowlist is current.
5. Add Namecheap to the "CBB Risk Register" SharePoint List.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (`03_-_Confidential/`) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/Namecheap/Namecheap_Security_Review.md` |
| **Cross-references** | `Namecheap_Architecture_Reference.md`; `Namecheap_Acquisition_Brief.md`; `Azure_Key_Vault_Architecture_Reference.md`; "CBB Risk Register" SharePoint List |
| **Created** | 2026-06-09 |
| **Last updated** | 2026-06-09 |
| **Next full review due** | 2027-06-09 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| DRAFT | 2026-06-09 | Claude Code | — | — | Initial draft. Posture partially verified (GDPR/DPA confirmed via Namecheap legal pages; SOC 2/ISO from third-party aggregators, flagged for direct confirmation). Flags personal-password-store gap and registrar-only DNS-delegation context. Recommends Approve with conditions. Version number to be assigned by Founder. |
