Security Posture Self-Assessment
How Calchis measures itself against three frameworks. This is the company’s own assessment, not an audit: no certification or attestation is held, and every “met” below is a claim you are entitled to verify. The written posture is at /security.
SOC 2 Type II
Control Environment — Security policies documented
The written security posture is published at /security; no formal policy set has been adopted or reviewed
Communication — Security awareness training
Risk Assessment — Threat identification
Error monitoring and per-tier rate limiting are in place; no formal threat model exists
Monitoring — Continuous security monitoring
Error alerting and per-feed data health are monitored and published at /status; there is no security-event monitoring (intrusion, anomalous access) beyond the providers' own
Access Control — Authentication & authorization
Email-and-password and magic-link sign-in; row-level security on every tenant table; tier-based feature gates. Single factor only — see CJIS Advanced Authentication below
System Operations — Security incident response
No written security incident response plan. The product's ICS incident tooling is for customers' emergencies, not for breaches of this platform, and does not count
Change Management — Version control
Version control with a CI gate on every change; schema changes are numbered, reviewed migrations
Data Integrity — Input validation
Server-side validation on every API route; Content Security Policy headers
Availability — Backup & recovery
The database provider takes automated daily backups and the hosting provider keeps instant deployment rollbacks; no restore drill has been run
SSO / Identity Provider Integration
Enterprise SSO is planned with no committed date. Current sign-in is email-and-password or a magic link, single factor.