Compliance programmes and readiness evidence

Enterprise prospects under mutual NDA receive each of the following artefacts. The public summary above describes them at a high level.

• Control matrix mapping every Trust Services Criterion to implementing code, configuration, or runbook.
• CI hardening evidence (ci.yml, live-monitoring.yml, daily-sweep.yml) and recent run logs.
• Output of the weekly internal penetration-test suite: anonymous reads and writes against row-level security, authentication fuzzing of edge functions, sensitive-column exposure, cross-tenant reads, admin-scope escalation, and secret configuration checks.
• Breakglass session logs showing M-of-N approval and time-bounded access.
• DSAR cadence with erasure (tombstoning) evidence and sample fulfilment timeline.
• Sub-processor list and Schrems III hashed-signal architecture diagram. Executed sub-processor DPAs are in progress and not yet part of the package.
• Incident response playbooks and 72-hour breach notification runbook (GDPR Article 33).
• Daily codebase sweep aggregating secrets, PII, RLS, bundle, edge, audit, and memory checks.
• 30-day backfill gate on the internal SOC 2 evidence-period marker: it is not set until shield_health_snapshots has at least 30 calendar days of evidence. The marker is internal readiness state, not an audit observation window.
• Cron heartbeat observability across every scheduled compliance job (shield_cron_heartbeat), surfaced in the admin Operations view.
• Per-tenant cost attribution covering edge-function invocations and AI-model spend (shield_function_cost_metrics).

Each programme is owned, evidenced, and reviewed at least quarterly. Status reflects the current state, not a target.