Trust Center · SOC 2
We are mid-audit and not yet certified. No signed report, no badge we haven't earned. This page is the live status of our controls, updated monthly so you can watch the work rather than take our word for it.
Framework: SOC 2 (AICPA Trust Services Criteria, 2017 TSC rev. 2022). We are pursuing type i first, then a type ii observation window, scoped to the Security, Availability, Confidentiality trust service categories. When the Type I report is signed we'll publish the date here and make the executive summary available under NDA at security@tailroster.com.
Monthly update
Updated — within our 30-day cadence.
Last month, we
Landed the launch-hardening evidence that doubles as SOC 2 evidence: Dependabot is on a weekly cadence and the Gitleaks secret-scan is a hard merge gate on every PR. AI tool calls now verify facility ownership before every facility read/write (ALE-2973), and product analytics no longer carry auth tokens or PII (ALE-2627). We also ran a full marketing-truth pass (ALE-3117) so every public security claim — including this page — matches what actually exists.
Next month, we will
Land the audit_log UPDATE/DELETE immutability migration and the backup-restore-drill plumbing that writes durable restore evidence. Start the quarterly access-review cadence across Supabase, Vercel, GitHub, and Stripe.
Controls
Each row maps to a Trust Services Criterion and a real mechanism in the product. “Operating” means the control runs today and would survive a walkthrough; “In progress” means the design exists but not yet the cadence an auditor tests over time; “Planned” is deferred until the formal audit starts.
CC8.1 — Change management — peer-reviewed, gated changes
CODEOWNERS routes review by path; migrations, jobs, and agent files require two owners. CI runs migration-lint, a typegen-drift gate, and the unit suite on every PR to main.
CC7.2 — Anomaly detection & continuous service-health monitoring
A 5-minute health-watchdog cron writes service_health_state and fires alerts; an external uptime ping backs it. Covered for service health.
CC6.6 / CC6.7 — Encryption in transit & at rest; no committed secrets
Inherited from Supabase (AES-256 at rest) and Vercel (TLS 1.3). .gitignore blocks .env files; migrations scan clean of secrets.
CC6.3 — Tenant isolation as the trust boundary
JWT tenant_id claim drives row-level security on every tenant table. Enforced in production; the real-DB isolation test still skips in CI, so we count operating-evidence as not-yet-complete.
CC6.1 / CC6.2 — Logical access — least privilege & provisioning trail
Seven-role RBAC with per-user permission overrides and audit columns on every access change. The recurring access-review cadence (the periodic-attestation half) is not yet running.
CC7.2 / CC7.3 — Append-only audit trail of privileged actions
An audit_log written from ~98 source files with insert-deny RLS so tenant users can't forge rows. Full UPDATE/DELETE immutability and a single central writer are in flight (audit-log hardening migration).
CC7.1 / CC8.1 — Dependency & secret hygiene as a merge gate
Dependabot runs weekly with grouped minor/patch PRs, pnpm audit blocks PRs on high/critical advisories, and a Gitleaks secret scan is a hard gate on every PR. The 30-day patch SLA is the documented commitment these enforce.
A1.2 — Availability — backups proven to restore
Supabase automated backups + PITR are inherited. A scheduled restore-drill that writes durable evidence is being stood up; until an isolated restore target is provisioned it is a deliberate no-op.
CC2.x / CC7.4 — Operations & incident response runbooks
Per-integration runbooks plus an on-call escalation doc exist and are operationally real. Framing them as a TSC-mapped written policy set is a Phase-1 task.
CC6.1 / CC6.2 — Quarterly access review across all four control planes
A quarterly attestation across Supabase, Vercel, GitHub, and Stripe. Template is written; the recurring review starts when SOC 2 is triggered.
Evidence automation — Continuous evidence collection platform
A compliance platform (Vanta / Drata / SecureFrame) connected to GitHub, Workspace, Vercel, Supabase, and Stripe. Deferred until an enterprise deal requires SOC 2.
If SOC 2 is a procurement requirement, email security@tailroster.com and we'll walk you through current status, the audit timeline, and what we can share under NDA today. For the rest of our posture — subprocessors, encryption, data residency — see the Trust Center.
Last updated: · Updated monthly · Total controls tracked: 11
