- ✅ Implemented — Control is in place and operational
- 🔄 In Progress — Partially implemented; completion planned
- 📋 Planned — Tracked in Linear roadmap; not yet implemented
ISO 27001 — Annex A Controls
A.5 — Information Security Policies
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.5.1.1 | Information security policies | 🔄 In Progress | Technical controls implemented; formal policy document in progress |
| A.5.1.2 | Review of information security policies | 📋 Planned | Tied to formal policy completion |
A.6 — Organization of Information Security
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.6.1.1 | Information security roles and responsibilities | 🔄 In Progress | RBAC roles defined; formal RACI not documented |
| A.6.1.2 | Segregation of duties | ✅ Implemented | Owner/admin/developer/operator role separation |
| A.6.2.1 | Mobile device policy | 📋 Planned | Not yet documented |
A.8 — Asset Management
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.8.1.1 | Inventory of assets | 📋 Planned | SBOM / dependency inventory tracked in BORD-170 |
| A.8.2.1 | Classification of information | 🔄 In Progress | PII identified and handled; formal classification not documented |
| A.8.3.1 | Management of removable media | ✅ Implemented | N/A — cloud-only architecture, no removable media |
A.9 — Access Control
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.9.1.1 | Access control policy | ✅ Implemented | Workspace-scoped RBAC enforced at every API route |
| A.9.2.1 | User registration and de-registration | ✅ Implemented | Invite-only; removal triggers session revocation |
| A.9.2.2 | User access provisioning | ✅ Implemented | Role assigned at invite; admin-controlled |
| A.9.2.3 | Management of privileged access | ✅ Implemented | Owner/admin roles scoped; separate from operator/developer |
| A.9.2.4 | Management of secret authentication | ✅ Implemented | SHA-256 hashed API keys, Vault for tenant secrets |
| A.9.2.5 | Review of user access rights | 📋 Planned | Periodic access review workflow not yet implemented |
| A.9.3.1 | Use of secret authentication information | ✅ Implemented | Password policy: 12 chars, uppercase, digit |
| A.9.4.1 | Information access restriction | ✅ Implemented | All data queries scoped to resolved workspaceId |
| A.9.4.2 | Secure log-on procedures | ✅ Implemented | Supabase Auth with session timeboxing |
| A.9.4.3 | Password management system | ✅ Implemented | Minimum length and complexity enforced |
| A.9.4.4 | Use of privileged utility programs | ✅ Implemented | Admin operations require owner/admin role |
A.10 — Cryptography
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.10.1.1 | Policy on the use of cryptographic controls | ✅ Implemented | TLS in transit, Vault at rest, SHA-256 hashing |
| A.10.1.2 | Key management | ✅ Implemented | Vault manages encryption keys; per-workspace scoping |
A.12 — Operations Security
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.12.1.1 | Documented operating procedures | 🔄 In Progress | Runbook in operations/runbook.mdx |
| A.12.2.1 | Controls against malware | 📋 Planned | Dependency scanning (SBOM) tracked in BORD-170 |
| A.12.3.1 | Information backup | ✅ Implemented | Supabase automated backups |
| A.12.4.1 | Event logging | ✅ Implemented | audit_logs table for all write operations |
| A.12.4.2 | Protection of log information | 📋 Planned | Tamper-evident hash chain (BORD-168) |
| A.12.4.3 | Administrator and operator logs | ✅ Implemented | Member removal, secret changes, GDPR erasures logged |
| A.12.6.1 | Management of technical vulnerabilities | 📋 Planned | SBOM and vulnerability scanning (BORD-170) |
A.13 — Communications Security
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.13.1.1 | Network controls | ✅ Implemented | CORS allowlist, security headers, HSTS |
| A.13.1.3 | Segregation in networks | ✅ Implemented | Per-workspace data isolation |
| A.13.2.1 | Information transfer policies | ✅ Implemented | TLS enforced; PII pseudonymized for AI |
A.14 — System Acquisition, Development, Maintenance
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.14.2.1 | Secure development policy | 🔄 In Progress | Security review process documented; SDLC policy in progress |
| A.14.2.5 | Secure system engineering principles | ✅ Implemented | Workspace isolation by design, input validation, output sanitization |
| A.14.3.1 | Protection of test data | 🔄 In Progress | Production data not used in dev; formal policy pending |
A.15 — Supplier Relationships
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.15.1.1 | Information security policy for supplier relationships | 🔄 In Progress | Sub-processor list documented; DPA review in progress |
| A.15.1.2 | Addressing security within supplier agreements | 🔄 In Progress | Supabase DPA in place; others under review |
A.16 — Information Security Incident Management
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.16.1.1 | Responsibilities and procedures | 📋 Planned | Incident response workflow (BORD-166) |
| A.16.1.2 | Reporting information security events | 📋 Planned | Anomaly detection + alerting (BORD-166) |
| A.16.1.5 | Response to information security incidents | 📋 Planned | Breach notification workflow (BORD-166) |
A.17 — Business Continuity
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.17.1.1 | Planning information security continuity | 🔄 In Progress | Supabase HA; formal BCP not documented |
| A.17.2.1 | Availability of information processing facilities | ✅ Implemented | Vercel + Supabase managed availability; health monitoring |
A.18 — Compliance
| Control | Requirement | Status | Notes |
|---|---|---|---|
| A.18.1.3 | Protection of records | ✅ Implemented | Audit logs with minimum 365-day retention |
| A.18.1.4 | Privacy and protection of PII | ✅ Implemented | GDPR data rights, pseudonymization, retention policy |
| A.18.2.1 | Independent review of information security | 📋 Planned | Adversarial audit performed; periodic reviews not yet scheduled |
GDPR — Key Articles
| Article | Requirement | Status | Notes |
|---|---|---|---|
| Art.5 | Principles of processing (lawfulness, minimization) | 🔄 In Progress | Technical controls in place; data mapping documentation pending |
| Art.6 | Lawful basis for processing | 🔄 In Progress | Operator responsibility; platform supports consent/legitimate interest |
| Art.13 | Privacy notices at collection | 📋 Planned | Template privacy notice for operators; implementation pending |
| Art.15 | Right of access | ✅ Implemented | GET /api/contacts/[id]/gdpr |
| Art.17 | Right to erasure | ✅ Implemented | DELETE /api/contacts/[id]/gdpr with in-place anonymization |
| Art.20 | Right to data portability | ✅ Implemented | Machine-readable JSON export via Art.15 endpoint |
| Art.25 | Data protection by design and by default | ✅ Implemented | PII pseudonymization on by default; workspace isolation by design |
| Art.28 | Data processing agreements | 🔄 In Progress | Supabase DPA in place; others under review |
| Art.32 | Security of processing | ✅ Implemented | Encryption, access controls, RBAC, audit logging |
| Art.33 | Breach notification to supervisory authority (72h) | 📋 Planned | Incident workflow (BORD-166) |
| Art.34 | Communication to data subjects | 📋 Planned | Scope assessment workflow (BORD-166) |
| Art.35 | Data Protection Impact Assessment (DPIA) | 📋 Planned | DPIA not yet conducted; required before high-risk processing |
NIS2 — Key Articles
| Article | Requirement | Status | Notes |
|---|---|---|---|
| Art.21(2)(a) | Risk analysis and information system security policies | 🔄 In Progress | Security audit completed; formal policy in progress |
| Art.21(2)(b) | Incident handling | 📋 Planned | BORD-166 |
| Art.21(2)(c) | Business continuity and crisis management | 🔄 In Progress | Supabase HA; formal BCP pending |
| Art.21(2)(d) | Supply chain security | 🔄 In Progress | Sub-processor list; DPA review in progress |
| Art.21(2)(e) | Security in network and information systems acquisition | ✅ Implemented | Zod validation, security headers, TLS |
| Art.21(2)(f) | Policies and procedures for cybersecurity risk management | 🔄 In Progress | Controls in place; formal documentation pending |
| Art.21(2)(h) | Basic cyber hygiene practices and cybersecurity training | 📋 Planned | Not yet formalized |
| Art.21(2)(i) | Human resources security and access control | ✅ Implemented | RBAC, invite-only, session revocation |
| Art.21(2)(j) | Authentication MFA | 📋 Planned | Supabase TOTP available; enforcement planned |
| Art.23 | Reporting obligations (24h early warning) | 📋 Planned | BORD-166 |
HIPAA — Technical Safeguards (§164.312)
| Safeguard | Requirement | Status | Notes |
|---|---|---|---|
| §164.312(a)(1) | Access control | ✅ Implemented | RBAC with workspace isolation |
| §164.312(a)(2)(i) | Unique user identification | ✅ Implemented | Supabase Auth user IDs |
| §164.312(a)(2)(ii) | Emergency access procedure | 📋 Planned | Break-glass procedure not formalized |
| §164.312(a)(2)(iii) | Automatic logoff | ✅ Implemented | 1h inactivity timeout |
| §164.312(a)(2)(iv) | Encryption and decryption | ✅ Implemented | TLS in transit, Vault at rest; column-level planned BORD-171 |
| §164.312(b) | Audit controls | ✅ Implemented | audit_logs for write operations; read-access logging planned BORD-168 |
| §164.312(c)(1) | Integrity controls | 🔄 In Progress | Input validation (Zod); tamper-evident logs planned BORD-168 |
| §164.312(d) | Person or entity authentication | ✅ Implemented | Session auth + API key auth on all routes |
| §164.312(e)(1) | Transmission security | ✅ Implemented | TLS enforced for all connections |
| §164.312(e)(2)(ii) | Encryption in transit | ✅ Implemented | TLS 1.2+ on all paths |
SOC 2 — Trust Service Criteria
CC1 — Control Environment
| Criteria | Requirement | Status | Notes |
|---|---|---|---|
| CC1.1 | COSO principle — demonstrates commitment to integrity | 🔄 In Progress | Security controls implemented; governance docs in progress |
| CC1.2 | Board oversight | 📋 Planned | Not yet formalized for startup stage |
| CC1.5 | Holds individuals accountable | ✅ Implemented | RBAC + audit logging for accountability |
CC2 — Communication and Information
| Criteria | Requirement | Status | Notes |
|---|---|---|---|
| CC2.1 | Information to support internal control | 🔄 In Progress | Audit logs in place; dashboards planned |
| CC2.2 | Internal communication | 🔄 In Progress | Runbooks documented; formal comms policy pending |
| CC2.3 | External communication | 🔄 In Progress | Sub-processor documentation; breach notification planned |
CC3 — Risk Assessment
| Criteria | Requirement | Status | Notes |
|---|---|---|---|
| CC3.1 | Specifies objectives | 🔄 In Progress | Compliance targets defined; formal risk register pending |
| CC3.2 | Identifies and analyzes risk | ✅ Implemented | Adversarial security audit completed |
| CC3.3 | Considers fraud risk | 🔄 In Progress | Workspace isolation prevents cross-tenant fraud; formal assessment pending |
CC6 — Logical and Physical Access Controls
| Criteria | Requirement | Status | Notes |
|---|---|---|---|
| CC6.1 | Logical access security measures | ✅ Implemented | RBAC, workspace isolation, session management |
| CC6.2 | Prior to issuing system credentials | ✅ Implemented | Invite-only; API keys scoped to workspace |
| CC6.3 | Role-based access | ✅ Implemented | Owner/admin/developer/operator roles |
| CC6.6 | Logical access from outside the system | ✅ Implemented | CORS allowlist, API auth required |
| CC6.7 | Restricts the transmission of data | ✅ Implemented | TLS enforced; PII pseudonymized for AI |
| CC6.8 | Prevents unauthorized removal of data | 🔄 In Progress | RBAC restrictions; DLP not yet implemented |
CC7 — System Operations
| Criteria | Requirement | Status | Notes |
|---|---|---|---|
| CC7.1 | Detection of vulnerabilities | 🔄 In Progress | Sentry error monitoring; dependency scanning planned BORD-170 |
| CC7.2 | Monitoring for anomalous activity | 📋 Planned | BORD-166 |
| CC7.3 | Evaluates security events | 📋 Planned | BORD-166 |
| CC7.4 | Responds to identified security vulnerabilities | 🔄 In Progress | Ad-hoc; formal process planned |
| CC7.5 | Identifies and responds to breaches | 📋 Planned | BORD-166 |
CC8 — Change Management
| Criteria | Requirement | Status | Notes |
|---|---|---|---|
| CC8.1 | Change management process | ✅ Implemented | GitHub PR workflow; CI/CD documented in operations/cicd |
CC9 — Risk Mitigation
| Criteria | Requirement | Status | Notes |
|---|---|---|---|
| CC9.1 | Identifies and manages risks from vendors | 🔄 In Progress | Sub-processor list; formal vendor risk assessment pending |
| CC9.2 | Assesses and manages risks from business partners | 🔄 In Progress | Meta, Supabase, Vercel relationships documented |
This matrix reflects the current state of Switchbord’s compliance posture. Planned items are actively tracked in Linear. For questions about a specific control or to request evidence artifacts for a vendor assessment, contact the Switchbord security team.