Security & compliance readiness

What Diffbridge already does towards SOC 2 and ISO 27001, what the company running it still has to do, and a path to a first report. A certification is about how the organisation operates over time, so no code can earn one on its own. This page is for whoever runs the hosted service: the operator.

Policy templates to adapt live in the repository's docs/compliance/ folder: information security, access control, change management, incident response, vendor management, and data retention. Backup and recovery are covered in Operations.

#Controls built into the product

SOC 2 Trust Services Criteria (Security, plus Availability and Confidentiality), with the ISO 27001:2022 Annex A control each one serves.

#What the operator still has to do

These are organisational controls: written down, done, and recorded with evidence.

1. Scope and ownership. Name a security owner. Write down the scope: the hosted Diffbridge service, its cloud account, the GitHub organisation, and the people with access.
2. Policies. Adapt the templates in docs/compliance/, have management approve them, and have staff acknowledge them every year.
3. Risk assessment. A yearly risk register (threats, likelihood, impact, treatment), reviewed when something big changes.
4. People. Background checks where lawful, security awareness training at hire and yearly, and a documented onboarding and offboarding checklist.
5. Access reviews. Quarterly review of who can reach production (cloud console, SSH, GitHub admins, platform admins), recorded with the reviewer's sign-off.
6. Endpoint security. Company laptops encrypted, screen lock, OS updates, and malware protection, tracked by an MDM tool.
7. Production hardening. MFA on the cloud console, GitHub and the domain registrar; SSH by key only, restricted by IP; unattended security upgrades; branch protection with required reviews on main.
8. Vulnerability management. Dependabot and the npm audit gate in CI are in place. Add image scanning, and a yearly third-party penetration test with tracked remediation. An internal code review (November 2026) reported 18 findings; 17 are fixed with regression tests in apps/server/src/security-fixes.test.ts and the other was already handled. An external test is still needed.
9. Vendors. Keep the vendor register (template) and collect each provider's SOC 2 report or equivalent yearly.
10. Incidents and continuity. Run a tabletop exercise yearly, and the recovery drill quarterly (Operations).
11. Customer commitments. Diffbridge serves a security page, a sub-processor list, terms and a privacy policy (/security, /subprocessors, /terms, /privacy) and security.txt (set SECURITY_CONTACT). They name MOKAHUB LLC (Florida) as the operator. A company still needs a data processing agreement and a lawyer's review. Then set LEGAL_EFFECTIVE_DATE and LEGAL_HOSTING_REGION in .env.

#Path to a report

1. Readiness (1–2 months). Do the list above. A compliance platform (Vanta, Drata, Secureframe, Sprinto) speeds this up: it connects to the cloud account, GitHub and HR tools, tracks policies and collects evidence automatically.
2. SOC 2 Type I. An auditor (a licensed CPA firm) checks the controls are designed properly at one point in time. Usually the first report enterprise buyers accept.
3. SOC 2 Type II. The same controls checked as they operate over 3–12 months. Most enterprise procurement asks for this one, renewed yearly.
4. ISO 27001 if customers in Europe or Asia ask for it: an ISMS (the policies, risk process and reviews above), a Statement of Applicability, internal audit, management review, then a two-stage certification audit by an accredited body. The SOC 2 work covers most of it.

Self-hosting customers run Diffbridge in their own cloud, so it falls under their controls. Give them this page, the security manual, and the operations guide for their own audits.