Compliance programmes, audit timelines, and readiness evidence

Enterprise prospects under mutual NDA receive each of the following artefacts. The public summary above describes them at a high level.

• Control matrix mapping every Trust Services Criterion to implementing code, configuration, or runbook.
• CI hardening evidence (ci.yml, live-monitoring.yml, memory-verification.yml) and recent run logs.
• Internal pentest suite output covering authentication, RLS boundaries, SSRF surfaces, and rate limits.
• Breakglass session logs showing M-of-N approval and time-bounded access.
• DSAR cadence with cryptographic shredding evidence and sample fulfilment timeline.
• Sub-processor list with executed DPAs and Schrems III hashed-signal architecture diagram.
• Incident response playbooks and 72-hour breach notification runbook (GDPR Article 33).
• Daily codebase sweep aggregating secrets, PII, RLS, bundle, edge, audit, and memory checks.
• 30-day backfill gate on the SOC 2 observation-window opener—refuses to open until shield_health_snapshots has at least 30 calendar days of evidence.
• Cron heartbeat observability across every scheduled compliance job (shield_cron_heartbeat), surfaced in the admin Operations view.
• Per-tenant cost attribution covering edge-function invocations and AI-model spend (shield_function_cost_metrics).

Each programme is owned, evidenced, and reviewed at least quarterly. Status reflects the current state, not a target.