INTERNAL ADMIN
Security and recovery
Review record protection, backup readiness and assurance work.
Evidence pendingData protection requirements
Encrypted storage and transport
All tenant records and documents; separate field protection for access details.
Organization isolation
Server checks and row-level policies must reject cross-organization queries.
Permanent test history
No scheduled deletion of test records or filed PDFs.
Recovery operations · specimen
| Control | Required policy | Evidence |
|---|---|---|
| Daily backup | 30-day point-in-time recovery | Implementation evidence pending |
| Restore exercise | Quarterly | No production exercise recorded |
| SOC 2 Type I | P2, when a Company prospect requires it | Not certified |