> ## Documentation Index
> Fetch the complete documentation index at: https://docs.switchbord.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance Matrix

> Full mapping of ISO 27001, GDPR, NIS2, HIPAA, and SOC 2 controls to Switchbord implementation status.

This matrix maps each compliance control to its implementation status in Switchbord. Use this as a starting point for your compliance assessment or vendor questionnaire.

**Status legend:**

* ✅ **Implemented** — Control is in place and operational
* 🔄 **In Progress** — Partially implemented; completion planned
* 📋 **Planned** — Tracked in Linear roadmap; not yet implemented

***

## ISO 27001 — Annex A Controls

### A.5 — Information Security Policies

| Control | Requirement                             | Status         | Notes                                                              |
| ------- | --------------------------------------- | -------------- | ------------------------------------------------------------------ |
| A.5.1.1 | Information security policies           | 🔄 In Progress | Technical controls implemented; formal policy document in progress |
| A.5.1.2 | Review of information security policies | 📋 Planned     | Tied to formal policy completion                                   |

### A.6 — Organization of Information Security

| Control | Requirement                                     | Status         | Notes                                          |
| ------- | ----------------------------------------------- | -------------- | ---------------------------------------------- |
| A.6.1.1 | Information security roles and responsibilities | 🔄 In Progress | RBAC roles defined; formal RACI not documented |
| A.6.1.2 | Segregation of duties                           | ✅ Implemented  | Owner/admin/developer/operator role separation |
| A.6.2.1 | Mobile device policy                            | 📋 Planned     | Not yet documented                             |

### A.8 — Asset Management

| Control | Requirement                   | Status         | Notes                                                            |
| ------- | ----------------------------- | -------------- | ---------------------------------------------------------------- |
| A.8.1.1 | Inventory of assets           | 📋 Planned     | SBOM / dependency inventory tracked in BORD-170                  |
| A.8.2.1 | Classification of information | 🔄 In Progress | PII identified and handled; formal classification not documented |
| A.8.3.1 | Management of removable media | ✅ Implemented  | N/A — cloud-only architecture, no removable media                |

### A.9 — Access Control

| Control | Requirement                              | Status        | Notes                                                      |
| ------- | ---------------------------------------- | ------------- | ---------------------------------------------------------- |
| A.9.1.1 | Access control policy                    | ✅ Implemented | Workspace-scoped RBAC enforced at every API route          |
| A.9.2.1 | User registration and de-registration    | ✅ Implemented | Invite-only; removal triggers session revocation           |
| A.9.2.2 | User access provisioning                 | ✅ Implemented | Role assigned at invite; admin-controlled                  |
| A.9.2.3 | Management of privileged access          | ✅ Implemented | Owner/admin roles scoped; separate from operator/developer |
| A.9.2.4 | Management of secret authentication      | ✅ Implemented | SHA-256 hashed API keys, Vault for tenant secrets          |
| A.9.2.5 | Review of user access rights             | 📋 Planned    | Periodic access review workflow not yet implemented        |
| A.9.3.1 | Use of secret authentication information | ✅ Implemented | Password policy: 12 chars, uppercase, digit                |
| A.9.4.1 | Information access restriction           | ✅ Implemented | All data queries scoped to resolved workspaceId            |
| A.9.4.2 | Secure log-on procedures                 | ✅ Implemented | Supabase Auth with session timeboxing                      |
| A.9.4.3 | Password management system               | ✅ Implemented | Minimum length and complexity enforced                     |
| A.9.4.4 | Use of privileged utility programs       | ✅ Implemented | Admin operations require owner/admin role                  |

### A.10 — Cryptography

| Control  | Requirement                                 | Status        | Notes                                                |
| -------- | ------------------------------------------- | ------------- | ---------------------------------------------------- |
| A.10.1.1 | Policy on the use of cryptographic controls | ✅ Implemented | TLS in transit, Vault at rest, SHA-256 hashing       |
| A.10.1.2 | Key management                              | ✅ Implemented | Vault manages encryption keys; per-workspace scoping |

### A.12 — Operations Security

| Control  | Requirement                             | Status         | Notes                                                |
| -------- | --------------------------------------- | -------------- | ---------------------------------------------------- |
| A.12.1.1 | Documented operating procedures         | 🔄 In Progress | Runbook in `operations/runbook.mdx`                  |
| A.12.2.1 | Controls against malware                | 📋 Planned     | Dependency scanning (SBOM) tracked in BORD-170       |
| A.12.3.1 | Information backup                      | ✅ Implemented  | Supabase automated backups                           |
| A.12.4.1 | Event logging                           | ✅ Implemented  | `audit_logs` table for all write operations          |
| A.12.4.2 | Protection of log information           | 📋 Planned     | Tamper-evident hash chain (BORD-168)                 |
| A.12.4.3 | Administrator and operator logs         | ✅ Implemented  | Member removal, secret changes, GDPR erasures logged |
| A.12.6.1 | Management of technical vulnerabilities | 📋 Planned     | SBOM and vulnerability scanning (BORD-170)           |

### A.13 — Communications Security

| Control  | Requirement                   | Status        | Notes                                  |
| -------- | ----------------------------- | ------------- | -------------------------------------- |
| A.13.1.1 | Network controls              | ✅ Implemented | CORS allowlist, security headers, HSTS |
| A.13.1.3 | Segregation in networks       | ✅ Implemented | Per-workspace data isolation           |
| A.13.2.1 | Information transfer policies | ✅ Implemented | TLS enforced; PII pseudonymized for AI |

### A.14 — System Acquisition, Development, Maintenance

| Control  | Requirement                          | Status         | Notes                                                                |
| -------- | ------------------------------------ | -------------- | -------------------------------------------------------------------- |
| A.14.2.1 | Secure development policy            | 🔄 In Progress | Security review process documented; SDLC policy in progress          |
| A.14.2.5 | Secure system engineering principles | ✅ Implemented  | Workspace isolation by design, input validation, output sanitization |
| A.14.3.1 | Protection of test data              | 🔄 In Progress | Production data not used in dev; formal policy pending               |

### A.15 — Supplier Relationships

| Control  | Requirement                                            | Status         | Notes                                                 |
| -------- | ------------------------------------------------------ | -------------- | ----------------------------------------------------- |
| A.15.1.1 | Information security policy for supplier relationships | 🔄 In Progress | Sub-processor list documented; DPA review in progress |
| A.15.1.2 | Addressing security within supplier agreements         | 🔄 In Progress | Supabase DPA in place; others under review            |

### A.16 — Information Security Incident Management

| Control  | Requirement                                | Status     | Notes                                   |
| -------- | ------------------------------------------ | ---------- | --------------------------------------- |
| A.16.1.1 | Responsibilities and procedures            | 📋 Planned | Incident response workflow (BORD-166)   |
| A.16.1.2 | Reporting information security events      | 📋 Planned | Anomaly detection + alerting (BORD-166) |
| A.16.1.5 | Response to information security incidents | 📋 Planned | Breach notification workflow (BORD-166) |

### A.17 — Business Continuity

| Control  | Requirement                                       | Status         | Notes                                                     |
| -------- | ------------------------------------------------- | -------------- | --------------------------------------------------------- |
| A.17.1.1 | Planning information security continuity          | 🔄 In Progress | Supabase HA; formal BCP not documented                    |
| A.17.2.1 | Availability of information processing facilities | ✅ Implemented  | Vercel + Supabase managed availability; health monitoring |

### A.18 — Compliance

| Control  | Requirement                                | Status        | Notes                                                           |
| -------- | ------------------------------------------ | ------------- | --------------------------------------------------------------- |
| A.18.1.3 | Protection of records                      | ✅ Implemented | Audit logs with minimum 365-day retention                       |
| A.18.1.4 | Privacy and protection of PII              | ✅ Implemented | GDPR data rights, pseudonymization, retention policy            |
| A.18.2.1 | Independent review of information security | 📋 Planned    | Adversarial audit performed; periodic reviews not yet scheduled |

***

## GDPR — Key Articles

| Article | Requirement                                         | Status         | Notes                                                                  |
| ------- | --------------------------------------------------- | -------------- | ---------------------------------------------------------------------- |
| Art.5   | Principles of processing (lawfulness, minimization) | 🔄 In Progress | Technical controls in place; data mapping documentation pending        |
| Art.6   | Lawful basis for processing                         | 🔄 In Progress | Operator responsibility; platform supports consent/legitimate interest |
| Art.13  | Privacy notices at collection                       | 📋 Planned     | Template privacy notice for operators; implementation pending          |
| Art.15  | Right of access                                     | ✅ Implemented  | `GET /api/contacts/[id]/gdpr`                                          |
| Art.17  | Right to erasure                                    | ✅ Implemented  | `DELETE /api/contacts/[id]/gdpr` with in-place anonymization           |
| Art.20  | Right to data portability                           | ✅ Implemented  | Machine-readable JSON export via Art.15 endpoint                       |
| Art.25  | Data protection by design and by default            | ✅ Implemented  | PII pseudonymization on by default; workspace isolation by design      |
| Art.28  | Data processing agreements                          | 🔄 In Progress | Supabase DPA in place; others under review                             |
| Art.32  | Security of processing                              | ✅ Implemented  | Encryption, access controls, RBAC, audit logging                       |
| Art.33  | Breach notification to supervisory authority (72h)  | 📋 Planned     | Incident workflow (BORD-166)                                           |
| Art.34  | Communication to data subjects                      | 📋 Planned     | Scope assessment workflow (BORD-166)                                   |
| Art.35  | Data Protection Impact Assessment (DPIA)            | 📋 Planned     | DPIA not yet conducted; required before high-risk processing           |

***

## NIS2 — Key Articles

| Article      | Requirement                                               | Status         | Notes                                               |
| ------------ | --------------------------------------------------------- | -------------- | --------------------------------------------------- |
| Art.21(2)(a) | Risk analysis and information system security policies    | 🔄 In Progress | Security audit completed; formal policy in progress |
| Art.21(2)(b) | Incident handling                                         | 📋 Planned     | BORD-166                                            |
| Art.21(2)(c) | Business continuity and crisis management                 | 🔄 In Progress | Supabase HA; formal BCP pending                     |
| Art.21(2)(d) | Supply chain security                                     | 🔄 In Progress | Sub-processor list; DPA review in progress          |
| Art.21(2)(e) | Security in network and information systems acquisition   | ✅ Implemented  | Zod validation, security headers, TLS               |
| Art.21(2)(f) | Policies and procedures for cybersecurity risk management | 🔄 In Progress | Controls in place; formal documentation pending     |
| Art.21(2)(h) | Basic cyber hygiene practices and cybersecurity training  | 📋 Planned     | Not yet formalized                                  |
| Art.21(2)(i) | Human resources security and access control               | ✅ Implemented  | RBAC, invite-only, session revocation               |
| Art.21(2)(j) | Authentication MFA                                        | 📋 Planned     | Supabase TOTP available; enforcement planned        |
| Art.23       | Reporting obligations (24h early warning)                 | 📋 Planned     | BORD-166                                            |

***

## HIPAA — Technical Safeguards (§164.312)

| Safeguard           | Requirement                     | Status         | Notes                                                                   |
| ------------------- | ------------------------------- | -------------- | ----------------------------------------------------------------------- |
| §164.312(a)(1)      | Access control                  | ✅ Implemented  | RBAC with workspace isolation                                           |
| §164.312(a)(2)(i)   | Unique user identification      | ✅ Implemented  | Supabase Auth user IDs                                                  |
| §164.312(a)(2)(ii)  | Emergency access procedure      | 📋 Planned     | Break-glass procedure not formalized                                    |
| §164.312(a)(2)(iii) | Automatic logoff                | ✅ Implemented  | 1h inactivity timeout                                                   |
| §164.312(a)(2)(iv)  | Encryption and decryption       | ✅ Implemented  | TLS in transit, Vault at rest; column-level planned BORD-171            |
| §164.312(b)         | Audit controls                  | ✅ Implemented  | `audit_logs` for write operations; read-access logging planned BORD-168 |
| §164.312(c)(1)      | Integrity controls              | 🔄 In Progress | Input validation (Zod); tamper-evident logs planned BORD-168            |
| §164.312(d)         | Person or entity authentication | ✅ Implemented  | Session auth + API key auth on all routes                               |
| §164.312(e)(1)      | Transmission security           | ✅ Implemented  | TLS enforced for all connections                                        |
| §164.312(e)(2)(ii)  | Encryption in transit           | ✅ Implemented  | TLS 1.2+ on all paths                                                   |

***

## SOC 2 — Trust Service Criteria

### CC1 — Control Environment

| Criteria | Requirement                                           | Status         | Notes                                                      |
| -------- | ----------------------------------------------------- | -------------- | ---------------------------------------------------------- |
| CC1.1    | COSO principle — demonstrates commitment to integrity | 🔄 In Progress | Security controls implemented; governance docs in progress |
| CC1.2    | Board oversight                                       | 📋 Planned     | Not yet formalized for startup stage                       |
| CC1.5    | Holds individuals accountable                         | ✅ Implemented  | RBAC + audit logging for accountability                    |

### CC2 — Communication and Information

| Criteria | Requirement                             | Status         | Notes                                                    |
| -------- | --------------------------------------- | -------------- | -------------------------------------------------------- |
| CC2.1    | Information to support internal control | 🔄 In Progress | Audit logs in place; dashboards planned                  |
| CC2.2    | Internal communication                  | 🔄 In Progress | Runbooks documented; formal comms policy pending         |
| CC2.3    | External communication                  | 🔄 In Progress | Sub-processor documentation; breach notification planned |

### CC3 — Risk Assessment

| Criteria | Requirement                  | Status         | Notes                                                                      |
| -------- | ---------------------------- | -------------- | -------------------------------------------------------------------------- |
| CC3.1    | Specifies objectives         | 🔄 In Progress | Compliance targets defined; formal risk register pending                   |
| CC3.2    | Identifies and analyzes risk | ✅ Implemented  | Adversarial security audit completed                                       |
| CC3.3    | Considers fraud risk         | 🔄 In Progress | Workspace isolation prevents cross-tenant fraud; formal assessment pending |

### CC6 — Logical and Physical Access Controls

| Criteria | Requirement                            | Status         | Notes                                         |
| -------- | -------------------------------------- | -------------- | --------------------------------------------- |
| CC6.1    | Logical access security measures       | ✅ Implemented  | RBAC, workspace isolation, session management |
| CC6.2    | Prior to issuing system credentials    | ✅ Implemented  | Invite-only; API keys scoped to workspace     |
| CC6.3    | Role-based access                      | ✅ Implemented  | Owner/admin/developer/operator roles          |
| CC6.6    | Logical access from outside the system | ✅ Implemented  | CORS allowlist, API auth required             |
| CC6.7    | Restricts the transmission of data     | ✅ Implemented  | TLS enforced; PII pseudonymized for AI        |
| CC6.8    | Prevents unauthorized removal of data  | 🔄 In Progress | RBAC restrictions; DLP not yet implemented    |

### CC7 — System Operations

| Criteria | Requirement                                     | Status         | Notes                                                         |
| -------- | ----------------------------------------------- | -------------- | ------------------------------------------------------------- |
| CC7.1    | Detection of vulnerabilities                    | 🔄 In Progress | Sentry error monitoring; dependency scanning planned BORD-170 |
| CC7.2    | Monitoring for anomalous activity               | 📋 Planned     | BORD-166                                                      |
| CC7.3    | Evaluates security events                       | 📋 Planned     | BORD-166                                                      |
| CC7.4    | Responds to identified security vulnerabilities | 🔄 In Progress | Ad-hoc; formal process planned                                |
| CC7.5    | Identifies and responds to breaches             | 📋 Planned     | BORD-166                                                      |

### CC8 — Change Management

| Criteria | Requirement               | Status        | Notes                                                   |
| -------- | ------------------------- | ------------- | ------------------------------------------------------- |
| CC8.1    | Change management process | ✅ Implemented | GitHub PR workflow; CI/CD documented in operations/cicd |

### CC9 — Risk Mitigation

| Criteria | Requirement                                       | Status         | Notes                                                     |
| -------- | ------------------------------------------------- | -------------- | --------------------------------------------------------- |
| CC9.1    | Identifies and manages risks from vendors         | 🔄 In Progress | Sub-processor list; formal vendor risk assessment pending |
| CC9.2    | Assesses and manages risks from business partners | 🔄 In Progress | Meta, Supabase, Vercel relationships documented           |

***

<Note>
  This matrix reflects the current state of Switchbord's compliance posture. Planned items are actively tracked in Linear. For questions about a specific control or to request evidence artifacts for a vendor assessment, contact the Switchbord security team.
</Note>