Compliance program

Overview#

Program artifacts#

• SOC 2 Type I kickoff

  Pre-observation checklist mapping Qtangl controls (RLS, audit log, key lifecycle) to CC-series evidence.

  Repository path: docs/compliance/soc2-type1-kickoff.md

  View on GitHub →

• Penetration test scope

  TH-001 SSRF/live-scan scope, metadata IP blocks, and remediation ticket linkage for external testers.

  Repository path: docs/compliance/pen-test-scope.md

  View on GitHub →

• Legal review checklist

  DPA/MSA/BAA review items, subprocessors, and marketing claim guardrails before enterprise contracts.

  Repository path: docs/compliance/legal-review-checklist.md

  View on GitHub →

• Remediation audit sampling

  Sampling methodology for remediation evidence during SOC 2 observation.

  Repository path: docs/compliance/remediation-audit-sampling.md

  View on GitHub →

• SOC 2 sensor controls

  Host sensor control mapping for enterprise discovery pilots.

  Repository path: docs/compliance/soc2-sensor-controls.md

  View on GitHub →

• Discovery pen test scope

  Optional sensor/binary discovery scope for external testers.

  Repository path: docs/compliance/discovery-pen-test-scope.md

  View on GitHub →

• Employee security policy

  v0.1 founder-signed policy for SOC 2 observation prep.

  Repository path: docs/compliance/employee-security-policy.md

  View on GitHub →

• Platform backup runbook

  Postgres backup, evidence retention, and quarterly restore drill checklist.

  Repository path: docs/ops/platform-backup-restore-runbook.md

  View on GitHub →

• Questionnaire drafts

  CAIQ Lite, SIG Lite, and top-20 FAQ for enterprise turnaround.

  Repository path: docs/compliance/questionnaires/security-questionnaire-faq.md

  View on GitHub →

• Contracts & insurance checklist

  Cyber insurance, vendor DPAs, and procurement artifacts required for regulated customers.

  Repository path: docs/compliance/contracts-insurance-checklist.md

  View on GitHub →

Request packaged evidence#

Enterprise customers may request CAIQ/SIG questionnaire responses, architecture summaries, and testing statements under NDA via /access. See also Legal artifacts.