Inside the SOC 2 readiness package
Eight artefacts that together describe how PasskeyBridge meets the Trust Services Criteria today. The public summary PDF describes them at a high level; the artefacts themselves are shared under mutual NDA after security-team review.
01.Trust Services Criteria control matrix
Every applicable TSC mapped to an implementing control with a direct pointer to the code, configuration, or runbook that satisfies it.
- CC1–CC9 common criteria coverage
- A1 availability controls (uptime SLO, capacity, monitoring)
- C1 confidentiality controls (encryption-at-rest/in-transit, key handling)
- Control owners and review cadence
- 30-day backfill gate on the observation-window opener (shield_open_soc2_observation_window)
02.CI hardening evidence
GitHub Actions workflows demonstrating SHA-pinned actions, least-privilege tokens, secrets/PII checks, bundle-budget gates, and audit-gate enforcement.
- ci.yml—lint, build, test, secrets, bundle, audit gates
- live-monitoring.yml—production health probes
- memory-verification.yml—memory document drift checks
- daily-sweep.yml—aggregated nightly compliance sweep
- codeql.yml + dependency-review.yml—static analysis and supply-chain gates
03.Internal penetration-test suite
Automated validators that prove RLS isolation, authentication boundaries, SSRF protection, rate limits, and admin-route gating.
- Cross-tenant RLS regression suite
- SSRF allowlist exercise via safeFetch
- Anti-enumeration probes on public edge functions
- Honeypot canary verification (shield-canary-verify)
04.Breakglass session logs
M-of-N quorum approval traces with time-bounded access windows, automatic revocation, and after-action reviews.
- Approver quorum membership + rotation log
- Sample session: opened, approved, used, auto-closed
- Post-incident after-action template
05.DSAR fulfilment cadence
Data Subject Access Request handling with cryptographic shredding evidence and a sample fulfilment timeline.
- 1-hour idempotency window enforcement
- Crypto-shred proof on rotation
- Sample anonymised request → response audit trail
06.Sub-processor list & DPAs
Executed Data Processing Agreements with each sub-processor, plus the Schrems III hashed-signal architecture diagram showing why no PII crosses borders.
- Current sub-processor inventory
- Executed DPAs (mutual-NDA gated)
- Hashed-signal data-flow diagram
07.Incident-response playbooks
Runbooks for detection, containment, eradication, recovery, and 72-hour breach notification under GDPR Article 33.
- Severity rubric and on-call escalation
- Comms templates (regulators, customers, public)
- Tabletop exercise log
08.Daily codebase sweep
Aggregated nightly checks across secrets, PII, RLS, bundle size, edge functions, audit posture, and memory drift—with a dashboard at /admin.
- shield_sweep_reports immutable history
- Daily emailed summary to repo@passkeybridge.io
- Admin dashboard rendering of report HTML
- Cron heartbeat freshness across every scheduled compliance job (shield_cron_heartbeat)
Review cadence
Each artefact is reviewed at least quarterly. The package is re-issued whenever a control owner changes, a sub-processor is added, or a workflow gate changes materially.