6Implemented controls
Trust Center
Trust should be
auditable, not implied.
Current control status for enterprise procurement. Implemented controls are separated from partial or planned controls. SOC 2 and ISO 27001 are not claimed as certifications.
2Partial controls
7Planned controls
7Compliance artifacts tracked
Control registry
Per-key rate limit and monthly quotaPartialPersistence model implemented; request enforcement is being activated.
Restricted CORSImplementedProduction origins restricted.
Sensitive dotfile blockingImplementedHidden files are blocked from public access.
ISO/IEC 27001PlannedNot certified.
Independent penetration testPlannedIndependent external test not yet completed.
SOC 2 Type IIPlannedNot certified.
Multi-factor authenticationPlannedNot yet implemented.
OIDC enterprise SSOPlannedPlanned; not claimed as available.
Organization/workspace RBACPartialCore data model implemented; application enforcement is being activated.
SAML 2.0 enterprise SSOPlannedPlanned; not claimed as available.
SCIM provisioningPlannedPlanned; not claimed as available.
TLS and HSTSImplementedHTTPS enforced with HSTS.
Database restore drillImplementedProduction/restore critical counts compared successfully.
Encrypted transport backup to R2 with checksumImplementedDaily database backup with remote checksum verification.
Environment-only application secretsImplementedNo literal DB password/DSN findings in active Python code.
What is already evidenced
Restricted CORS, hidden-file blocking, environment-only application secrets, daily R2 database backup with remote checksum validation, and restore-drill evidence are implemented controls.
What remains external
Independent penetration testing, SOC 2 Type II and ISO/IEC 27001 remain planned. They are procurement workstreams, not current certifications.
Request security review →