Retention windows and Trust Services Criteria coverage
A public, citable view of how long each evidence class is retained, and how every applicable Trust Services Criterion maps to an implementing control with a direct pointer.
Retention schedule
Hot windows reflect what is queryable from the application surface; cold-archive windows reflect what auditors can request for re-validation. Every retention row links to its anchor.
| Evidence class | Storage | Retention | Basis |
|---|---|---|---|
| Tenant audit log (shield_audit_log) | Append-only Postgres table, RLS-scoped | 13 months hot, 7 years cold archive | SOC 2 CC7.2 / ISO 27001 A.12.4 |
| Availability snapshots (shield_health_snapshots) | Append-only Postgres table, public-read summary | 13 months | SOC 2 A1.x continuous monitoring |
| Daily codebase sweep reports (shield_sweep_reports) | Append-only Postgres + emailed HTML summary | 13 months | SOC 2 CC8.1 change management |
| Quarterly access reviews (shield_access_reviews) | Append-only Postgres, admin-only | 7 years | SOC 2 CC6.1 / CC6.2 logical access |
| Change register (shield_change_register) | Append-only Postgres, admin-only | 7 years | SOC 2 CC8.1 change management |
| Incident register (shield_incident_register) | Append-only Postgres, admin-only | 7 years | SOC 2 CC7.3 / CC7.4 incident response |
| Breakglass session logs | Append-only Postgres + after-action review | 7 years | SOC 2 CC6.1 privileged access |
| Edge function status & cost metrics | Aggregated Postgres rollups | 13 months | SOC 2 A1.x capacity & monitoring |
| DSAR fulfilment records | Append-only Postgres + cryptographic shred proof | 3 years (request metadata only; no PII retained) | GDPR Art. 15-22 / PIPEDA Principle 9 |
| Honeypot canary hits (shield_canary_hits) | Append-only Postgres, admin-only | 13 months | SOC 2 CC7.2 anomaly detection |
Trust Services Criteria control matrix
Every applicable TSC mapped to the implementing control and the evidence pointer. Detailed artefacts ship under mutual NDA via the readiness package.
- CC1.x
Control environment
Documented governance, code-of-conduct, and signed contributor agreements; founder-level approval for sub-processor changes.
- LICENSE, SECURITY.md, CONTRIBUTING.md at repo root
- Sub-processor list (NDA-gated)
- CC2.x
Communication & information
Public Trust Center, status page, and changelog; internal Slack channels for security and incident comms.
- /trust-center, /status, /changelog
- shield-soc2-notify email pipeline
- CC3.x
Risk assessment
Quarterly risk review covering threat model, sub-processor changes, and regulatory delta.
- Quarterly access review snapshots
- Memory-driven threat-model docs
- CC4.x
Monitoring activities
Daily codebase sweep, 5-minute health snapshots, runtime-alert widget, and per-status-code function metrics.
- shield_sweep_reports
- shield_health_snapshots
- shield_function_status_metrics
- CC5.x
Control activities
CI gates (lint/build/test/secrets/bundle/audit) plus pre-commit hooks block non-compliant changes from shipping.
- .github/workflows/ci.yml
- scripts/check-*.mjs
- CC6.1
Logical access—provisioning
Role-based access via has_role() security-definer; admin tier multi-gated; breakglass requires M-of-N quorum.
- public.has_role()
- user_roles table
- Breakglass protocol memory
- CC6.2
Logical access—review
Quarterly access-review snapshot via pg_cron captures admin counts, tenant memberships, and orphan flags.
- shield_access_reviews
- cron job shield-access-review-quarterly
- CC6.6
External access boundaries
Edge functions enforce JSON guards, SSRF allowlist, rate limits, DPoP binding, and per-tenant quotas.
- safeFetch egress allowlist
- DPoP shadow telemetry
- Pass-3 quota enforcement
- CC6.7
Data in transit
TLS 1.3 enforced at the edge; hybrid ML-DSA-65 + HMAC-SHA-256 signatures on identity assertions; P-256 ECDSA tenant keys published for DID-based verification.
- Cloudflare TLS posture
- Hybrid signature scheme memory
- CC6.8
Malicious software prevention
SHA-pinned GitHub Actions, dependency audit gate, secrets scanner, and dist guard prevent supply-chain drift.
- check-secrets.mjs
- check-dist.mjs
- Vite 6 upgrade memory
- CC7.1
System operations—detection
Honeypot canary endpoints with Slack alerts, blocking audit gate, and on-demand E2E verification.
- shield_canary_hits
- shield-canary-verify
- CC7.2
System operations—anomaly
Pass-5 platform-wide anomaly scanner covers traffic, error, latency, egress, cascade, and tenant concentration.
- Pass 5 anomaly detection memory
- AdminRuntimeGuardWidget
- CC7.3
Incident response—evaluation
Incident register with severity rubric (Sev 1-4), root-cause documentation, and after-action template.
- shield_incident_register
- AdminIncidentRegisterWidget
- CC7.4
Incident response—recovery
Runbooks for detection, containment, eradication, recovery; 72-hour breach notification under GDPR Art. 33.
- IR playbooks (NDA-gated)
- Communication templates
- CC8.1
Change management
Every merged change is captured via daily-sweep trigger into the change register; migrations require review.
- shield_change_register
- trg_sweep_to_change_register
- CC9.x
Risk mitigation
Sub-processor DPAs executed; cyber-insurance in force; vendor-risk review prior to onboarding new providers.
- Executed DPAs
- Insurance certificate (NDA-gated)
- A1.1
Availability—capacity
Per-tenant quotas, edge cost telemetry, function status rollups, and capacity dashboards.
- shield_function_cost_metrics
- Per-tenant quotas memory
- A1.2
Availability—backup
Daily automated Postgres backups via managed cloud platform with snapshot restore.
- Managed platform backup posture
- A1.3
Availability—recovery testing
Quarterly tabletop exercise covers backup restore, key rotation, and breakglass session.
- Tabletop log (NDA-gated)
- C1.1
Confidentiality—identification
Zero-PII architecture; personal identifiers keyed-hashed (HMAC-SHA-256 under a server-held pepper); Purpose-Bound PII Vault for the rare cases requiring reversibility.
- Privacy & governance memory
- PBPBV encryption design
- C1.2
Confidentiality—disposal
Cryptographic shredding via tenant-key rotation removes ability to decrypt prior data within 24-hour grace window.
- Tenant key management memory
- DSAR shred proof
Related documentation
This page is reviewed at least quarterly and re-issued whenever a control owner changes, a sub-processor is added, or a workflow gate changes materially.