Compliance

​

Table of Contents

1. Executive Summary
2. SOC 2 Type II Compliance
3. ISO 27001:2022 Compliance
4. GDPR Compliance
5. System and Organization Controls (SOC 2 Trust Service Criteria)
6. Risk Assessment & Treatment
7. Evidence Repository
8. Audit Preparation Checklist
9. Continuous Compliance Program

​

Executive Summary

​

Certification Roadmap

​

Key Achievements

• ✅ 100% Critical Security Issues Resolved (7 vulnerabilities eliminated)
• ✅ Comprehensive Audit Logging (2-year retention, tamper-evident)
• ✅ Automated Security Testing (CI/CD pipeline with 8 security jobs)
• ✅ Encryption at Rest & In Transit (AES-256-GCM, TLS 1.3)
• ✅ Role-Based Access Control (RBAC) with Row-Level Security (RLS)
• ✅ Incident Response Plan (documented in SECURITY.md)
• ✅ Vulnerability Management (automated scanning + responsible disclosure)

​

SOC 2 Type II Compliance

​

Trust Service Criteria (TSC)

​

CC1: Control Environment

​

CC2: Communication and Information

​

CC3: Risk Assessment

​

CC4: Monitoring Activities

​

CC5: Control Activities

​

CC6: Logical and Physical Access Controls

​

CC7: System Operations

​

CC8: Change Management

​

CC9: Risk Mitigation

​

Additional Criteria (Confidentiality)

​

C1: Confidential Information

​

ISO 27001:2022 Compliance

​

Annex A Controls Implementation

​

A.5 Organizational Controls

• Control: Management-approved security policy
• Implementation: SECURITY.md document
• Evidence: This document, last updated 2026-01-08

• Control: Defined security roles
• Implementation: RBAC system with 4 roles
• Evidence: types/schema.ts, RLS policies

• Control: Separate roles for different functions
• Implementation: super_admin, admin, editor, viewer
• Evidence: Role definitions in database

• Control: Awareness of security threats
• Implementation: Snyk vulnerability database, GitHub Security Advisories
• Evidence: CI/CD pipeline integrations

• Control: Acceptable use policy
• Implementation: Security best practices
• Evidence: SECURITY.md § Security Best Practices

• Control: Classification and handling
• Implementation: PII fields marked and encrypted
• Evidence: lib/encryption.ts, field definitions

• Control: Secure data transfer
• Implementation: TLS 1.3, signed URLs
• Evidence: middleware.ts, app/actions/files.ts

• Control: Access control policy
• Implementation: RBAC + RLS
• Evidence: Auth guards, RLS policies

• Control: User identity management
• Implementation: WorkOS SSO
• Evidence: middleware.ts

• Control: Secure authentication
• Implementation: OAuth, SAML, Magic Link
• Evidence: WorkOS integration

• Control: Cloud security
• Implementation: SOC 2 certified vendors (Supabase, Vercel)
• Evidence: Vendor SOC 2 reports

• Control: Business continuity
• Implementation: Multi-region deployment, automated backups
• Evidence: Vercel global CDN, Supabase backups

​

A.6 People Controls

• Control: Background checks (where applicable)
• Implementation: HR policy (organizational level)
• Evidence: HR records

• Control: Security responsibilities in employment agreements
• Implementation: Organizational policy
• Evidence: Employment contracts

• Control: Security training
• Implementation: Developer security guidelines
• Evidence: SECURITY.md, CLAUDE.md

• Control: Access revocation
• Implementation: Team member removal
• Evidence: app/actions/teams.ts, audit logs

​

A.7 Physical Controls

• Scope: Not applicable (cloud-hosted application)
• Implementation: Deferred to infrastructure providers
• Evidence: Supabase/Vercel SOC 2 reports

​

A.8 Technological Controls

• Control: Secure user devices
• Implementation: Browser-based application, no client software
• Evidence: Web application architecture

• Control: Privileged access management
• Implementation: super_admin role, service role key management
• Evidence: Role definitions, environment variable security

• Control: Need-to-know access
• Implementation: RLS policies, form team membership
• Evidence: Supabase RLS policies

• Control: Source code protection
• Implementation: Private GitHub repository, branch protection
• Evidence: GitHub settings

• Control: Multi-factor authentication
• Implementation: WorkOS MFA support
• Evidence: WorkOS configuration

• Control: Resource monitoring
• Implementation: Vercel auto-scaling, Supabase connection pooling
• Evidence: Infrastructure configuration

• Control: Malware protection
• Implementation: Snyk vulnerability scanning, dependency audits
• Evidence: CI/CD pipeline

• Control: Vulnerability management
• Implementation: Automated scanning, responsible disclosure
• Evidence: .github/workflows/ci.yml, SECURITY.md

• Control: Secure configuration
• Implementation: Environment variables, no hardcoded secrets
• Evidence: .env.example, configuration documentation

• Control: Secure deletion
• Implementation: Cascade deletes, audit logging
• Evidence: Database schema, foreign keys

• Control: Data obfuscation
• Implementation: Field-level encryption
• Evidence: lib/encryption.ts

• Control: DLP measures
• Implementation: Logger PII filtering, secret scanning
• Evidence: lib/logger.ts, TruffleHog in CI/CD

• Control: Regular backups
• Implementation: Automated daily database backups
• Evidence: Supabase backup configuration

• Control: Redundancy
• Implementation: Multi-region Vercel deployment
• Evidence: Vercel global infrastructure

• Control: Event logging
• Implementation: Comprehensive audit logging
• Evidence: lib/audit-logger.ts, audit_logs table

• Control: System monitoring
• Implementation: Sentry error tracking, Vercel logs
• Evidence: Sentry dashboard

• Control: Time synchronization
• Implementation: UTC timestamps, NTP on infrastructure
• Evidence: Database timestamp fields

• Control: Privileged utility control
• Implementation: Service role key restricted to backend only
• Evidence: Environment variable configuration

• Control: Software installation control
• Implementation: Dependency lock files, npm audit
• Evidence: pnpm-lock.yaml, CI/CD pipeline

• Control: Network security
• Implementation: TLS 1.3, HTTPS enforcement
• Evidence: middleware.ts

• Control: Network service security
• Implementation: API authentication, signed URLs
• Evidence: middleware.ts, auth guards

• Control: Network segregation
• Implementation: Database network isolation (Supabase)
• Evidence: Supabase network configuration

• Control: Web content filtering
• Implementation: CSP headers
• Evidence: middleware.ts

• Control: Cryptographic controls
• Implementation: AES-256-GCM, TLS 1.3
• Evidence: lib/encryption.ts, middleware.ts

• Control: Secure SDLC
• Implementation: Security testing in CI/CD
• Evidence: .github/workflows/ci.yml

• Control: Security requirements
• Implementation: Security architecture documented
• Evidence: SECURITY.md § Security Architecture

• Control: Secure architecture
• Implementation: 5-layer defense-in-depth
• Evidence: SECURITY.md § Security Architecture

• Control: Secure coding practices
• Implementation: Developer guidelines, code review
• Evidence: CLAUDE.md, SECURITY.md

• Control: Security testing
• Implementation: 35 security tests, automated scanning
• Evidence: Test files, CI/CD pipeline

• Control: Third-party development security
• Implementation: N/A - all development in-house
• Evidence: Git commit history

• Control: Environment separation
• Implementation: main (production), feature branches (preview)
• Evidence: Deployment configuration, CLAUDE.md

• Control: Change control
• Implementation: PR reviews, CI/CD gates
• Evidence: GitHub branch protection, workflows

• Control: Test data protection
• Implementation: No production data in tests, mocked data
• Evidence: Test files with mock data

• Control: Audit protection
• Implementation: Read-only audit access, non-production testing
• Evidence: Audit procedures (to be documented)

​

GDPR Compliance

​

Key GDPR Principles

• ✅ Field-level encryption for sensitive data
• ✅ RLS policies for data isolation
• ✅ Minimal data collection (no unnecessary fields)
• ✅ Anonymous form support (no user association required)

• Timeline: 72 hours to supervisory authority
• Process: Documented in SECURITY.md § Incident Response
• Contacts: security@withunify.org

• Status: Initial DPIA completed (this document)
• Review: Annual review scheduled
• High-risk processing: Field-level encryption mitigates risks

​

GDPR Data Subject Rights

​

System and Organization Controls

​

Trust Service Criteria Summary

​

Risk Assessment & Treatment

​

Risk Register

​

Risk Treatment Plan

• Implement rate limiting (R-006 mitigation)
• Annual penetration testing (R-001, R-002 validation)
• Vendor security reviews (R-008 monitoring)

• DDoS protection enhancement
• Security awareness training program
• Incident response drills

• Advanced threat detection (SIEM)
• Security orchestration automation

​

Evidence Repository

​

Documentation Evidence

​

Code Evidence

​

Test Evidence

​

CI/CD Evidence

​

Audit Log Evidence

-- View all security-related events
SELECT * FROM audit_logs
WHERE action_type IN ('login', 'logout', 'delete', 'export')
ORDER BY created_at DESC;

-- View form access by user
SELECT * FROM audit_logs
WHERE entity_type = 'form'
  AND user_id = '<user_id>'
ORDER BY created_at DESC;

-- View changes to sensitive data
SELECT * FROM audit_logs
WHERE metadata->>'contains_pii' = 'true'
ORDER BY created_at DESC;

-- Detect unusual activity patterns
SELECT user_id, COUNT(*) as action_count
FROM audit_logs
WHERE created_at > NOW() - INTERVAL '1 hour'
GROUP BY user_id
HAVING COUNT(*) > 100;

​

Audit Preparation Checklist

​

Pre-Audit Activities (60 days before)

• Engage SOC 2 auditor (select from AICPA directory)
• Define audit scope (Terra production environment)
• Identify key personnel (CTO, Security Champion)
• Prepare organizational chart
• Document system architecture
• Update all security documentation
• Review vendor SOC 2 reports (Supabase, Vercel, WorkOS)
• Complete control self-assessment
• Gather evidence for all controls
• Schedule evidence collection meetings

​

Evidence Collection (Ongoing - 6 month observation)

• Review audit logs for anomalies
• Document security incidents (if any)
• Update risk register
• Review access control lists
• Verify backup completeness
• Run vulnerability scans

• Security training session
• Disaster recovery drill
• Vendor security review
• Penetration testing (annual)
• Update documentation

​

Audit Fieldwork (During audit period)

• Provide auditor with system access (read-only)
• Schedule interviews with key personnel
• Demonstrate control effectiveness
• Provide evidence samples:
  • 25 random audit log entries
  • 10 code review approvals
  • 5 vulnerability remediation examples
  • 3 access provisioning examples
  • 3 access revocation examples
• Answer auditor questions promptly
• Track audit findings

​

Post-Audit (After report issuance)

• Review draft SOC 2 report
• Address any findings or exceptions
• Implement management responses
• Distribute final report to customers
• Publish SOC 2 badge on website
• Plan for next audit cycle

​

Data Retention & Backup Policies

​

Data Retention Policy

• Form owners can set custom retention policies per form
• Submissions can be archived (soft delete) before permanent deletion
• Audit logs have fixed 2-year retention (non-configurable for compliance)

​

Backup Policy

• Frequency: Automated daily backups
• Retention: 7 days (rolling window)
• Type: Full database snapshots
• Location: Supabase managed storage (AWS S3)
• Encryption: AES-256 at rest
• Point-in-Time Recovery (PITR): Up to 7 days

• Frequency: Continuous (versioning enabled)
• Retention: Latest 10 versions per file
• Type: Object versioning
• Location: Supabase managed storage (AWS S3)
• Encryption: AES-256 at rest

• Frequency: Every commit (Git)
• Retention: Indefinite
• Location: GitHub (primary), developer machines (secondary)
• Encryption: HTTPS in transit

​

Disaster Recovery

• Recovery: Restore from latest daily backup
• Steps:
  1. Identify corruption scope
  2. Restore from Supabase backup (7-day window)
  3. Verify data integrity
  4. Resume operations
• Estimated Time: 1-2 hours

• Recovery: Rollback to previous deployment
• Steps:
  1. Identify failed deployment
  2. Rollback via Vercel dashboard
  3. Verify application functionality
  4. Investigate root cause
• Estimated Time: 15-30 minutes

• Recovery: Wait for provider recovery (multi-region architecture)
• Steps:
  1. Monitor provider status page
  2. Communicate with users via status page
  3. Provider auto-failover (Vercel global CDN)
  4. Verify service restoration
• Estimated Time: Provider-dependent (typically < 1 hour)

• Recovery: Restore from backups + re-deploy
• Steps:
  1. Contact Supabase support for backup restoration
  2. Re-deploy application via Vercel
  3. Restore database from backup
  4. Verify data integrity and functionality
  5. Notify affected users
• Estimated Time: 3-4 hours

• Frequency: Quarterly (Jan, Apr, Jul, Oct)
• Test Type: Backup restoration to staging environment
• Documentation: DR test reports in docs/dr-tests/

​

Third-Party Certifications

1. Annual review of vendor SOC 2 reports
2. Verify no “Type 1” findings or exceptions
3. Document any exceptions and mitigation plans
4. Maintain vendor contact list for incident response
5. Review vendor SLAs and uptime commitments

​

Continuous Compliance Program

​

Quarterly Activities (Every 3 months)

• Security review meeting
• Risk register update
• Disaster recovery drill
• Vendor SOC 2 report review (if available)
• Update security documentation
• Review access control lists
• Audit log review (sample 25 entries)

​

Annual Activities (Once per year)

• Annual risk assessment
• Penetration testing (third-party)
• ISO 27001 gap analysis
• Update DPIA (GDPR)
• Security awareness training

• SOC 2 audit (6-month observation + fieldwork)
• Policy review and updates
• Business continuity plan review
• Vendor security assessments

• ISO 27001 certification audit
• Incident response plan testing
• Compliance metrics review
• Update threat model

• Year-end compliance report
• Budget planning for security initiatives
• Compliance roadmap for next year
• Vendor contract renewals

​

Continuous Monitoring

• Vulnerability scanning (CI/CD pipeline)
• Secret scanning (TruffleHog)
• Error monitoring (Sentry)
• Uptime monitoring (Vercel)

• Review Sentry error trends
• Check CI/CD pipeline failures
• Monitor Vercel performance metrics

• Review audit log samples
• Security incident report (if any)
• Compliance dashboard update

​

Compliance Metrics Dashboard

​

Appendix A: Control Matrix

• Control ID (CC1.1, CC1.2, etc.)
• Control Description
• Control Owner
• Implementation Details
• Evidence Location
• Test Procedure
• Test Frequency
• Last Test Date
• Test Result
• Notes

​

Appendix B: Incident Response Contacts

• Security Champion: TBD (primary contact)
• CTO: TBD
• DevOps Lead: TBD

• SOC 2 Auditor: TBD (engage Q2 2026)
• Penetration Tester: TBD (engage Q1 2026)
• Legal Counsel: TBD
• Cyber Insurance: TBD

• Supabase: support@supabase.com
• Vercel: support@vercel.com
• WorkOS: support@workos.com

• Data Protection Authority (GDPR): (Depends on EU member state)
• State Attorney General (US breach notification): (Depends on state)

​

Appendix C: Privacy Policy (Template)

​

Key Sections:

1. Information We Collect
   • Account information (email, name)
   • Form submissions (user-provided data)
   • Usage data (analytics)
   • Log data (IP addresses, user agent)
2. How We Use Information
   • Provide form services
   • Authentication and authorization
   • Security monitoring
   • Product improvement
3. Data Sharing
   • Form owners receive submission data
   • Third-party service providers (Supabase, Vercel, etc.)
   • Legal compliance
4. Data Security
   • Encryption in transit (TLS 1.3)
   • Encryption at rest (AES-256-GCM)
   • Access controls (RBAC + RLS)
   • Audit logging
5. Your Rights (GDPR)
   • Right to access
   • Right to rectification
   • Right to erasure
   • Right to data portability
   • Right to object
6. Data Retention
   • See § Data Retention & Backup Policies
7. International Transfers
   • EU-US Data Privacy Framework (if applicable)
   • Standard Contractual Clauses
8. Contact Information
   • Email: privacy@withunify.org
   • DPO: TBD (if required)

​

Document Control

​

Conclusion

1. Engage SOC 2 auditor (Q1 2026)
2. Begin 6-month observation period (Q1-Q2 2026)
3. Complete SOC 2 Type II audit (Q2 2026)
4. Pursue ISO 27001 certification (Q3 2026)
5. Plan FedRAMP readiness (Q4 2026)