Security & compliance posture — RapidValue IGA (internal)

Reading note. This page is the truth source for due-diligence questionnaires. Don't claim certifications we don't have. SOC2 Type I + Type II are different — only Type II carries weight.

SOC2 Type II

~30%

controls drafted

GDPR

Compliant

DPA template + DPO retainer

Pentest

Not yet

Scheduled Q3 2026

Dependency audit

Weekly

pip-audit + npm audit

Certifications & audits

Item	Status	Notes
SOC2 Type II	In progress	Controls drafted in Vanta. Type I audit Q3 2026, Type II report ~Q1 2027.
ISO 27001	Not started	EU prospects prefer this over SOC2. Decide Q4 2026 whether to add or skip.
Annual penetration test	Scheduled	Vendor: TBD (Securify / Computest / Outpost24 in scope). ~€15k/yr.
HIPAA BAA-readiness	Partial	HIPAA audit-pack template implemented. BAA contract template draft. Encryption at rest ✓.
GDPR Article 32	Compliant	DPA template ready. DPO retainer engaged. Art. 17 erasure flow + Art. 20 portability built-in.
Cyber insurance	Quotes received	€5M coverage target. Quote contingent on SOC2 Type I completion.

Security controls (CLAUDE.md durable invariants)

Control	State	Where
audit_event immutable	Enforced	Postgres trigger (migration 0139)
Chain-hash on audit	Enforced	SHA256 prev + canonical row. Verify via `/audit/verify-chain`
Signed audit export	Enforced	HMAC-SHA256 NDJSON via `/audit/export`
Vault encryption	Enforced	AES-256-GCM. Key on separate disk (security rule #4).
JWT secret rotation	Manual	Quarterly via AWS Secrets Manager. Automate Q3.
MFA + password policy	Per-tenant	`tenant_password_policy` + TOTP MFA challenge flow
SSRF guard on tunnel mode	Enforced	Agent refuses any URL not starting with allowed_base_url
GDPR Art. 17 erasure	Enforced	Pseudonymisation; preserves audit_event per Art. 17(3)(b)
Hard-delete tenant	Gated	OFFBOARDING-status + typed-confirm. FK-cycle auto-break.
Production guards on secrets	Enforced	`IGA_VAULT_MASTER_KEY` required if `APP_ENV=production`
PyJWT (no python-jose)	Migrated	CVE chain in python-jose; PyJWT 2.x. Don't reintroduce.

Dependency audit

Workflow .github/workflows/dependency-audit.yml runs:

pip-audit --strict on backend (PR + push + weekly Monday 06:00 UTC)
npm audit --omit=dev --audit-level=high on frontend
Accepted-risk CVEs in backend/.audit-ignore with explicit justification
Local: ./scripts/audit_deps.sh

Current accepted risks: 0 (as of last weekly run). Recheck .audit-ignore for stale exemptions.

Infrastructure security

Layer	Control	State
Network	VPC private subnets for RDS	Enforced
Network	Security groups: EC2 → RDS port 5432 only	Enforced
Storage	RDS encryption at rest (KMS)	Enforced
Storage	S3 SSE encryption default	Enforced
Storage	S3 bucket policies: block public access	Enforced
Auth	EC2 IAM role (no long-lived keys)	Enforced
Auth	Secrets Manager for DB pw + vault key	Enforced
Edge	TLS 1.2+ enforced on ALB	Enforced
Edge	Wildcard cert via Let's Encrypt DNS-01	Enforced
Edge	WAF on ALB (managed rules)	Pending
Observability	CloudWatch alarms on RDS connections	Partial
Observability	GuardDuty enabled	Not enabled
Backup	RDS automated snapshots (7d)	Enforced
Backup	Daily S3 pgdump for Business+ tiers	Enforced
Backup	Monthly tested restore drill	Workflow scheduled

Open security risks

Single-region eu-west-1 for staging + prod. Region outage = full downtime. Mitigation: cross-region snapshot copy nightly to eu-central-1 (covers data-loss only, not RTO).
No WAF in production yet — manual rules pending. Risk: known-pattern attack surfaces. Mitigation timeline Q3.
No GuardDuty — VPC flow log anomaly detection not active. Cost $1/GB analyzed; low at current scale.
JWT secret rotation manual — quarterly cadence depends on team discipline. Automate via Lambda + CloudWatch Events.
EC2 instance not in TF state for staging — per CLAUDE.md infra/terraform/STAGING_DRIFT.md. Manual config drift risk.
Tier-3 agent: customer-side key compromise = full credential exposure. Mitigation: agent vault encryption + UC1 external key sources.

Incident-history (since 2026-05)

Date	Severity	Title	Resolution
2026-05-30	P2	Wizard 500 — missing enum migration	Migration 0165 added 2 enum values. Auto-deploy fix < 5 min.

Post-mortems land in docs/postmortems/ after every P1/P2.