Security Posture Self-Assessment
How Calchis measures itself against three frameworks. This is the company’s own assessment, not an audit: no certification or attestation is held, and every “met” below is a claim you are entitled to verify. The written posture is at /security.
SOC 2 Type II
Control Environment — Security policies documented
docs/security-policies.md, adopted 2026-09-26: access control, change management, secrets, data retention, vendors, backup, incident response — each naming where the tree enforces it. Written and adopted by the founder; reviewed by nobody independent
Communication — Security awareness training
Risk Assessment — Threat identification
Error monitoring and per-tier rate limiting are in place; no formal threat model exists
Monitoring — Continuous security monitoring
Error alerting and per-feed data health are monitored and published at /status; there is no security-event monitoring (intrusion, anomalous access) beyond the providers' own
Access Control — Authentication & authorization
Email-and-password and magic-link sign-in; row-level security on every tenant table; tier-based feature gates. TOTP two-factor is available to every account and required for operator routes, not yet required for every user — see CJIS Advanced Authentication below
System Operations — Security incident response
docs/security-incident-response.md, adopted 2026-09-26: what counts, severity and response times, contain-assess-notify-record steps, the switches and contacts. Never exercised; docs/security-incidents/ is empty, which is the honest count. The product's ICS tooling is for customers' emergencies and does not count
Change Management — Version control
Version control with a CI gate on every change; schema changes are numbered, reviewed migrations
Data Integrity — Input validation
Server-side validation on every API route; Content Security Policy headers
Availability — Backup & recovery
The database provider takes automated daily backups and the hosting provider keeps instant deployment rollbacks; no restore drill has been run
SSO / Identity Provider Integration
Enterprise SSO is planned with no committed date. Current sign-in (as of 2026-11-06) is email-and-password or a magic link, with TOTP two-factor available to every account and required for operator routes.