Yes, it is possible to get a security architecture and design review before starting development. You can schedule a technical office hours appointment with the Product Security team through the Partner Security Portal. Here are the key steps to prepare:
1. **Schedule Office Hours**: Log in to the Partner Security Portal, navigate to the Office Hours section, and select an appointment under Security Engineering Questions to discuss secure design practices and get tailored guidance.
2. **Integrate Security Early**: Incorporate security considerations into all stages of the development lifecycle and designate a security expert on your team.
3. **Create Architecture Documentation**: Prepare architecture diagrams showing data touchpoints, information flows, authentication, authorizations, and security controls.
4. **Establish Security Policies**: Create a corporate security policy outlining how customer assets like user data are protected.
5. **Inventory Dependencies**: Keep track of third-party libraries, their versions, and any sensitive data your solution processes or stores.
6. **Document Security Activities**: Include your development methodology, vulnerability management, and security-awareness training.
7. **Conduct Third-Party Audits**: Share audit summaries with stakeholders and list relevant certifications.
8. **Disclose Data Details**: Identify data storage locations, providers, and any third-party data sharing arrangements.
These sessions provide an opportunity to discuss secure-solution design and implementation, ask technical questions, and receive advice tailored to your solution before formal submission.