Self-policed readiness, not an attestation

AES-256-GCM at rest, TLS 1.3 in transit, field-level encryption for high-risk secrets.

37 organization-level permissions and custom roles. MFA enrollment is required before any user can seal, and a step-up TOTP check runs at sealing time on a 10-minute sudo window — satisfying SOC 2 CC6.1 (logical access controls) for the highest-trust operation in the system. Every gate outcome is recorded in the hash-chained audit log.

Tamper-evident event log; verifiable by an independent NIF you can run yourself.

Every production deploy ties to a git SHA; rollback is a redeploy of a known-good SHA.

Severity 1-4 classification with response targets; postmortem culture for sev 1-2 incidents.

Internal readiness work in progress (self-policed); external auditor engagement is a downstream step.

Separate signals for API, sealing, verification, AI, webhook delivery; real-time incident posting with engineer commentary.

Following SOC 2. Most controls map directly; the gap is documentation rigor, not implementation.

Most technical controls are already in place; the BAA is the contractual layer on top of the existing posture.

Adding the Privacy TSC in a subsequent observation period as customer demand emerges.

Driven by US government customer demand; significant infrastructure work to satisfy the controls catalog.

Type I is "you wrote down your controls." Type II is "the controls actually ran for several months." We treat Type I as a stop on the way, not the end.

Why we rejected it: Type I has the same SOC 2 logo on the cover and asks much less of the auditee. We are not interested in the same logo at lower cost — we want the report customers can actually rely on.

Self-written control descriptions are not evidence. They are advertising.

Why we rejected it: customers ask for SOC 2 because they want a third party to have looked at us. A page where we describe our own controls answers a different question — one customers did not ask.

The work is the audit. Outsourcing the audit prep to a tooling vendor does not change that.

Why we rejected it: tooling that helps collect evidence is fine. A "we will get you certified in 60 days" vendor that promises a shortcut is selling the appearance of compliance, not the thing itself.

Findings are how the audit improves the system. Hiding them is how the system stops improving.

Why we rejected it: customers learn more from how a vendor responds to a finding than from a clean report. We surface findings that affect customer-visible posture and document the remediation.