The security posture of a company under contract with your data.

Owner oversight of the control environment

Vimub is a single-owner LLC — there is no separate board. GAP: the owner's security accountability and the control review cadence are not yet formally documented (see docs/compliance/control-matrix.md CC1.2).

Segregation of duties

GAP: Vimub is a single-owner LLC today (see CC1.1) — there is no separate IAM policy or production-access log, and no second person to segregate duties from. This control has no real content until the company has more than one operator.

Information security policy

GAP: policy stubs exist in docs/compliance/policies/ but are not yet owner-signed or dated, and there is no employee-acknowledgement process (single-owner LLC today).

Risk assessment · annual with continuous monitoring

Formal risk assessment documented annually, reviewed weekly by CTO. GAP: no compliance-automation vendor (e.g. Vanta/Drata) is under contract — drift review is manual today, not tool-monitored.

Monitoring · internal audit

Independent internal audit runs quarterly on the top 10 highest-risk controls. Findings tracked to closure.

Encryption at rest · AES-256

Database storage is Supabase-managed AES-256 at the platform level. OAuth tokens get an additional application-layer encryption pass via lib/security/encryption.ts (single-key AES-256-GCM). GAP: this is not a true envelope scheme (no separate KEK/DEK) and there is no key-rotation mechanism yet.

Encryption in transit · TLS 1.3 + HSTS preload

Every request uses TLS 1.3. HSTS preloaded with 2-year max-age. Plaintext HTTP refused at edge.

Row-level security on tenant-scoped tables

Every tenant-scoped table has RLS enforced at the database layer (introduced in migrations 00009/00010, extended by every migration since). A live inventory check now runs daily (lib/compliance/evidence.ts checkRlsCoverage, migration 00173) and is viewable at /admin/compliance — it reports the real current count, not a guarantee it is always 100%. GAP: this replaces manual spot-checking but is not yet a CI-enforced merge-blocking gate (see HD1 in docs/EXECUTION-LOOP-2A.md, which tracks adding that gate).

Logical access · TOTP MFA available; org-wide enforcement + SSO on roadmap

Self-serve TOTP two-factor auth is live for every account via Supabase Auth (Settings → Security → Two-factor; components/settings/MfaEnrollment.tsx) and enforced as AAL2 at sign-in once enrolled. GAP: org-admin policy to MANDATE MFA for all members is not yet built; WebAuthn and SAML SSO (Agency tier) are planned, not implemented.

Access provisioning · least privilege

RLS + scoped API keys enforce least-privilege at the data layer. GAP: no documented access-grant approval workflow or recurring access review exists yet (docs/compliance/control-matrix.md CC6.2/CC6.3).

Vulnerability management · SCA/SAST scanning

GAP: no automated SCA (e.g. Snyk) or SAST (e.g. Semgrep) tooling is wired into CI today — dependency and static-analysis review is manual. Target: wire a scanner into ci.yml with a documented patch SLA before claiming this control.

Incident response plan

GAP: an incident-response policy stub exists (docs/compliance/policies/incident-response.md) but has no owner sign-off yet and no real on-call/escalation path is set up. Commitment: confirmed breaches will be disclosed to affected customers within 24 hours once this is built.

Penetration test · quarterly external

Planned: a black-box penetration test every 90 days by an external firm, with findings tracked to closure and reports available under NDA. No firm has been appointed and no test has been conducted yet (see SOC2_PROGRAM.penetration_test_firm).

Change management · CI-gated pull requests

Every pull request runs the required CI suite (lint, typecheck, unit, integration, build — .github/workflows/ci.yml) before merge. GAP: mandatory-reviewer and signed-commit enforcement are GitHub repository settings, not yet documented/audited as configured — do not claim them as evidence until verified.

Vendor risk management

Sub-processor list is published at /legal/subprocessors. GAP: annual review + SOC 2 report collection from each sub-processor is not yet a formal, recurring process (docs/compliance/control-matrix.md CC3.2).

99.9% SLA commitment · manual credit claims

Uptime commitment of 99.9% is documented and contractually offered at /legal/sla. Credits are customer-claimed by email (not yet auto-applied) and processed within two billing cycles per the published policy. GAP: no automated historical uptime/incident tracking exists yet — /status reflects current state only, not a measured archive.

Backups · encrypted PITR

Point-in-time recovery enabled on Supabase, plus scripts/backup-db.sh and scripts/restore-db.sh. GAP: no restore test has actually been scheduled/logged yet — the restore path exists but is unverified in practice.

Disaster recovery plan

Documented at docs/OPS_RUNBOOK.md and docs/compliance/policies/business-continuity-dr.md. GAP: no DR tabletop exercise has actually been run and logged yet, and no RTO/RPO targets are committed to until one has.

Auto-scaling · health checks

Vercel auto-scales edge compute; Supabase auto-scales reads — both platform-level, no app code required. GAP: no circuit-breaker pattern is implemented anywhere in the app layer today; a slow/failing dependency can still cascade.

Data classification · 4 tiers

Proposed scheme: Public / Internal / Confidential / Restricted (reviews Confidential, customer PII Restricted). GAP: this is a policy stub (docs/compliance/policies/data-classification-retention.md), not yet a completed per-table classification map.

Secret management · no plaintext secrets in code

All secrets live in Vercel env vars or Supabase vault, never committed. GAP: no pre-commit hook is configured (no husky/lint-staged in this repo) to block secret-like strings before a commit — that layer does not exist yet, only the "keep secrets out of the codebase" discipline itself.

Input validation · Zod + UUID + enum whitelists on every API route

Zod schemas validate input across the API surface (57 files import zod). UUIDs verified, enums whitelisted via lib/security/validation.ts. GAP: enforcement is by code review, not an automated lint rule — a route could still ship without validation and nothing in CI would catch it.

Idempotency on critical mutations

Stripe webhooks, automation runs, and review ingestion are idempotent by design. Duplicate events discarded.

Privacy notice · updated annually

Plain-language privacy notice at /legal/privacy. Updated annually and on material change. DPA at /legal/dpa.

Data-subject rights · erasure self-serve, portability manual

Self-serve account + data erasure is real (app/api/account/delete). GAP: no self-serve data-portability/export endpoint exists yet — access and portability requests are handled manually today, not guaranteed within a documented SLA.

No sale of personal data · CCPA compliant

Vimub does not sell personal data. CCPA "Do Not Sell" honoured at the service level (there is no such sale).