We meet you at industry standards

Every release ties to one git SHA; rollback is a redeploy of a previous SHA, not a manual revert.

Direct-to-origin requests are rejected at the edge. The origin is not in the public DNS attack surface.

Backups managed by Fly Postgres with point-in-time recovery available.

Per-request request_id flows through the stack. Telemetry events surface in Phoenix.LiveDashboard.

Every PR compiles clean and passes the full test suite before review; the main branch enforces the same.

Self-policed readiness in progress; external auditor not yet engaged.

Type 1 attests to control design at a point in time. Type II (operating effectiveness over a 3-12 month observation window) is a separate, later engagement.

Separate signals for API, sealing, verification, AI, webhook delivery. Real-time incident posting with engineer commentary.

Replaces the current internal-only status surface.

External red team engagement. Not yet engaged.

A first engagement is planned alongside the SOC 2 Type 1 readiness work.

Writes acknowledge only after at least one replica has accepted them; targets single-host failure tolerance.

Periodic restore exercises to a non-prod environment to verify functionality, not just file presence.

Recovery time and recovery point objectives published per environment, with annual DR exercises that exercise restoration end-to-end.

Following SOC 2. ISO 27001 maps closely to the same controls; the gap is documentation rigor, not implementation.

For customers in healthcare verticals. Most controls are already in place; the BAA is a contractual layer on top of the technical posture.

Per-region database + storage so EU customer data stays in EU and APAC stays in APAC. Driven by GDPR and comparable regional requirements.

A single-tenant deployment running in the customer's own AWS / Azure / GCP account, with the same operational model. For the small set of customers whose compliance needs preclude shared multi-tenant infrastructure.

Operating Kubernetes is a full-time job for a security and reliability team larger than ours.

Why we rejected it: Kubernetes gives flexibility, but the security and reliability burden of running it well — patching, etcd backups, network policies, RBAC drift — is a meaningful headcount commitment. Our managed host gives us per-app microVM isolation, edge proximity, and managed PostgreSQL without that overhead. We will revisit if our scale changes the tradeoff.

A hotfix that bypasses the same checks every other deploy uses is a hotfix that introduces a regression in the next hour.

Why we rejected it: every "we'll skip CI just this once" is followed by a postmortem about a missed test. The right answer is: make CI fast enough that nobody asks. Our pre-commit completes in seconds; CI completes in single-digit minutes. There is no "we don't have time" path.

A region outage that takes EngineeringID down for an afternoon costs more in customer trust than the DR cost saves.

Why we rejected it: cross-region replication adds latency and cost, but it is the table-stakes answer to "what happens when AWS us-east-1 goes down." Customers do not accept "it was the cloud provider" as an availability story.

A self-attestation has the same evidentiary weight as no attestation at all.

Why we rejected it: customers ask for SOC 2 because they want a third party to have looked at us, not because they want us to write a confident page. The audit is the point. We are doing the audit.