Inside the SOC 2 readiness package
Eight artefacts that together describe PasskeyBridge's controls against the Trust Services Criteria, and where the evidence is still short. The public summary PDF describes them at a high level; the artefacts themselves are shared under mutual NDA after security-team review.
01.Trust Services Criteria control matrix
Every applicable TSC mapped to an implementing control, with a pointer to the code, configuration, or runbook behind it and management's rating of how far the evidence goes, from operating to not yet evidenced.
- CC1–CC9 common criteria coverage
- A1 availability controls (uptime SLO, capacity, monitoring)
- C1 confidentiality controls (encryption-at-rest/in-transit, key handling)
- Evidence source and cadence for each control
- 30-day backfill gate on the internal evidence-period marker (shield_open_soc2_observation_window); internal readiness state, not an audit observation window
02.CI hardening evidence
GitHub Actions workflows demonstrating SHA-pinned actions, least-privilege tokens, secrets/PII checks, bundle-budget gates, and audit-gate enforcement.
- ci.yml—lint, build, test, secrets, bundle, audit gates
- live-monitoring.yml—production health probes
- daily-sweep.yml—aggregated nightly compliance sweep
- codeql.yml + dependency-review.yml—static analysis and supply-chain gates
03.Internal penetration-test suite
Automated weekly probes of row-level security, authentication boundaries, cross-tenant isolation, and admin-scope gating. A probe that cannot run is reported as not executed, never as a pass.
- Row-level security: anonymous reads on 53 tables and anonymous writes on the 6 most sensitive
- Authentication fuzzing: authenticated edge functions called with no, empty, forged, and wrong credentials
- Cross-tenant read probes and admin-scope escalation attempts
- Sensitive-column exposure and secret-configuration checks
04.Breakglass session logs
M-of-N quorum approval traces with time-bounded access windows, automatic revocation, and after-action reviews.
- Approver quorum membership + rotation log
- Sample session: opened, approved, used, auto-closed
- Post-incident after-action template
05.DSAR fulfilment cadence
Data Subject Access Request handling with erasure (tombstoning) evidence and a sample fulfilment timeline.
- Repeat requests: each re-runs the tombstoning and is recorded
- Erasure read-back: affected row counts per tombstoned table
- Sample anonymised request → response audit trail
06.Sub-processor list
The current sub-processor inventory with what each one receives, plus the Schrems III hashed-signal architecture diagram. Executed Data Processing Agreements with sub-processors are in progress and not yet part of the package.
- Current sub-processor inventory
- Hashed-signal data-flow diagram
07.Incident-response playbooks
Runbooks for detection, containment, eradication, recovery, and 72-hour breach notification under GDPR Article 33. No tabletop exercise has been run yet.
- Severity rubric and on-call escalation
- Comms templates (regulators, customers, public)
08.Daily codebase sweep
Aggregated nightly checks across secrets, PII, RLS, bundle size, edge functions, audit posture, and memory drift—with a dashboard at /admin.
- shield_sweep_reports immutable history
- Daily emailed summary to repo@passkeybridge.io
- Admin dashboard rendering of report HTML
- Cron heartbeat freshness across every scheduled compliance job (shield_cron_heartbeat)
Review cadence
Each artefact is reviewed at least quarterly. The package is re-issued whenever a control changes, a sub-processor is added, or a workflow gate changes materially.