Security & Compliance Center

The evidence trail an auditor reviews for SOC 2 / ISO 27001 — not a certificate. Certification itself requires a licensed external auditor; nothing on this page or in this app can grant one. What it can do is keep the record straight.

Security Architecture — What's Actually In Place

Access control: role-based permissions (Roles, Permissions, business-role assignment) gate every module — enforced server-side by PermissionGate on every page, not just hidden in the UI.
Audit trail: a global change log (audit_log) records table, record, action, who, and before/after state — the raw material a SOC 2 auditor samples from.
Approval workflow: configurable, sequential multi-step release strategies gate high-value documents (purchase orders, journal entries, requisitions) before they post.
Data at rest / in transit: encryption is provided by the underlying hosting infrastructure (Postgres + Vercel), not implemented in this application layer — a real gap for a compliance packet, which needs the hosting provider's own attestations referenced explicitly.
Secrets: API keys and credentials are stored in app_settings with an is_secret flag, never in source code.

Certification Status

Availability Log

Recorded from your own monitoring (status page, uptime service) — this app has no way to observe its own live deployment.

No checks recorded yet

Backup & Restore-Test Evidence

No backup records logged yet

Security Incident Log

No incidents logged — an empty log here is evidence, not an unused feature.

Data Processing Agreements

No DPAs on file yet