CSA Cloud Controls Matrix v4 — Self-Assessment

Audit policy documented in `docs/canonical/30_Chain_Verifier_Auditor_Runbook.md` and `31_Pilot_Ready_Attestation.md`. Single-founder operation; written policy maintained in `docs/canonical/` and reviewed at every release. No formal annual sign-off cycle yet — planned post first paying pilot.

No third-party SOC 2 / ISO 27001 / STAR Level 2 yet. Pen-test SoW drafted (`19_Pen_Test_RFP.md`); execution planned post first paying pilot.

Risk register maintained internally; SWOT v2 published (`01_SWOT_v2.md`). Re-reviewed every release.

Compliance scope mapped in `25_Pilot_Prospectus.md` and `32_Trust_Pack.md` (JFSC AML/CFT/CPF, DPJL 2018, UK GDPR-aligned).

Internal audit only (founder-led, evidenced via hash-chained audit trail). External audit programme not yet established.

Issues tracked in product `issues` table with status workflow, escalation, and audit-trailed remediation. See Trust Pack §6.

SDLC + interface security policy embedded in commit / review workflow; see `docs/canonical/architecture-overview.md`.

Baseline: TypeScript strict, RLS-by-default, no service-role on user paths, signed webhooks, CSP. Enforced in code review.

Dependency-scan + lint metrics in CI; no formal monthly metrics report yet.

Threat modelling at architecture-change time; secure-by-default patterns documented in `architecture-overview.md`.

Dependency-scan automated in CI; SAST coverage limited. DAST / pen-test deferred to `19_Pen_Test_RFP.md` engagement.

Lovable-managed CI/CD; every deploy is git-tracked and reproducible; rollback by re-deploy of prior commit.

Public Vulnerability Disclosure Policy at `regalign.app/vdp` (see `28_Vulnerability_Disclosure_Policy.md`); SLAs documented.

BCP outline at `07_BCP_Outline.md`. Reviewed at every major release.

BIA documented in BCP outline; RTO 8h / RPO 24h for tenant data (mirrors Trust Pack §8).

Strategy: rely on managed-platform multi-AZ + daily DB snapshots; founder-led incident response. See `07_BCP_Outline.md`.

Plan documented; named successor scoped in `16_Successor_Role_Spec.md`.

All BCP/DR docs in `docs/canonical/`; published Trust Pack §7.

No live BCP exercise executed yet. Tabletop scheduled for Q3 2026 once first pilot live.

Status page at `regalign.app/status`; incident communication via direct email to tenant admins.

Lovable Cloud (Supabase EU) daily automated backups; point-in-time recovery enabled. See Trust Pack §2.

DR plan documented in `07_BCP_Outline.md`; relies on managed-platform multi-AZ failover.

Not yet exercised; planned alongside BCR-06.

Managed platform (Cloudflare + Supabase EU) provides infrastructure redundancy. RegAlign owns no physical equipment.

Every change is a git commit with reviewer + deploy audit trail. Lovable-managed deploys.

Type-check + lint + Vitest required on every change; visual QA before publish.

Git + Lovable CI/CD. Append-only audit-trail with SHA-256 hash chain; per-page verifier at `regalign.app/verify`. See Trust Pack §6.

Only the founder can deploy; MFA-enforced on Lovable account. Branch protection on `main`.

Pilot Agreement (`05_Pilot_Agreement_Scaffold.md`) covers change-notification cadence.

Baseline = current `main` branch + last deployed commit SHA; reproducible by checkout.

Git tracks code drift; runtime config drift caught manually. Automated config-drift alerting deferred.

Exceptions logged as issues; require sign-off + audit-trail entry.

Rollback by re-deploying prior commit; DB rollback via Supabase PITR. RTO < 1h.

TLS 1.2+ in transit, AES-256 at rest (Lovable Cloud managed). Key custody is sub-processor side — see Trust Pack §2/§3.

Founder owns key-lifecycle decisions; day-to-day key custody is delegated to sub-processors (Cloudflare, Supabase).

TLS 1.2+ in transit, AES-256 at rest (Lovable Cloud managed). Key custody is sub-processor side — see Trust Pack §2/§3.

AES-256 at rest, TLS 1.2+ (incl. TLS 1.3) in transit. No proprietary crypto.

Crypto changes flow through normal CCC change process; sub-processor crypto changes tracked via vendor advisories.

Documented when crypto is changed; default = use sub-processor managed crypto, which has independent CBA.

Crypto-risk reviewed at architecture-change time; logged in risk register.

No application-layer envelope encryption today. Customer-managed keys (CMK) and bring-your-own-key (BYOK) are not supported. Data is encrypted at rest by the underlying database and storage sub-processors using their managed keys. Single-tenant CMK / BYOK on roadmap (post-Series-A). See /security/roadmap.

Internal review only; relies on sub-processor SOC 2 / ISO 27001 attestations.

Keys generated by sub-processors (Cloudflare, Supabase); no founder-managed long-lived keys other than API/webhook secrets.

Each key has a single purpose (TLS cert, DB encryption, webhook HMAC, API key signing).

Sub-processor keys rotated per their published schedule. Tenant API keys / webhook secrets rotatable on demand via `/admin/api-keys`.

API keys revocable instantly via operator UI; HTTP 401 returned on next call.

Revoked keys are deleted, not just disabled; sub-processor key destruction per their procedures.

API keys active on creation; sub-processor keys per their lifecycle.

API keys can be disabled (suspended) before deletion via operator UI.

Deactivation is identical to revocation for API keys; sub-processor lifecycle per their controls.

RegAlign-issued keys are not archived (no need: re-issue is one click). Sub-processor practice per their controls.

Suspected compromise → revoke + re-issue + audit-trail entry + tenant-admin notification.

Tenant API keys cannot be recovered after revocation; sub-processor key recovery per their controls.

Active keys listed at `/admin/api-keys` per tenant; webhook secrets at `/admin/regulator-endpoints`.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

Logical asset classification (data classification at table level, sensitivity tagged via `data_classification` column). Physical-asset classification N/A.

Logical asset inventory in `data-model-map.md` and `architecture-overview.md`. Physical assets N/A.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

N/A — RegAlign operates no physical data-centre, network cabling, surveillance or utility infrastructure. Hosting is managed by Cloudflare Workers and Lovable Cloud (Supabase EU); their published certifications apply to this domain.

Published privacy notice + DPIA template (`06_DPIA_Template.md`); JOIC-registered controller/processor (No. 103914).

Tenant deletion = hard delete + audit-trail entry. Backups expire per `15_Data_Retention_and_Deletion.md`.

Full data inventory in `data-model-map.md`; per-table sensitivity tagging.

`data_classification` column on tenant rows; `live_PROHIBITED` on pilot/sandbox tenants until uplift.

Data flow diagram + sub-processor map in `architecture-overview.md` and `14_Sub_Processor_List.md`.

Tenant = data owner; RegAlign = processor for tenant data, controller for account data. Documented in Pilot Agreement §3.

RLS-by-default on every table; tenant isolation enforced at query layer.

Minimum-necessary data collection; no special-category data accepted (enforced via upload guards).

DPIA template provided to every tenant (`06_DPIA_Template.md`); founder DPIA performed at architecture-change time.

All transfers TLS 1.2+; EU-only sub-processors for data path.

Operator UI supports DSAR / rectification / erasure; export at `/admin/data-export`.

Documented in Pilot Agreement §3; tenant data not used for product improvement without explicit consent.

Public sub-processor list at `regalign.app/trust` and in `14_Sub_Processor_List.md`; changes notified 30 days in advance per Pilot Agreement §7.

Public sub-processor list at `regalign.app/trust` and in `14_Sub_Processor_List.md`; changes notified 30 days in advance per Pilot Agreement §7.

Production data never used in dev/test; pilot/sandbox tenants flagged with `live_PROHIBITED` and enforce upload guards.

Published policy at `15_Data_Retention_and_Deletion.md`; tenant-level retention overrideable per Pilot Agreement.

No special-category data accepted; enforced by upload guards + onboarding checklist.

Breach-notification SLA: 24h to tenant + JOIC per DPJL 2018; documented in BCP outline and Pilot Agreement §8.

All tenant data resides in EU (Lovable Cloud EU region). Cloudflare edge does not persist tenant data.

Governance documented in `docs/canonical/` (Trust Pack, Sub-processor list, BCP, DPIA, Retention, VDP, AI-use disclosure).

Internal risk register + SWOT (`01_SWOT_v2.md`); reviewed every release.

Canonical docs reviewed at every release; review log in `.lovable/handover/`.

Exceptions logged in `issues` with sign-off + audit-trail; documented in Pilot Agreement §6.

Trust Pack (`32_Trust_Pack.md`) is the published programme summary.

Founder is accountable owner; successor role scoped in `16_Successor_Role_Spec.md`.

Regulatory mapping per `25_Pilot_Prospectus.md` (JFSC AML/CFT/CPF, DPJL 2018) and the in-product Compass methodology.

Founder participates in CSA / FCA / JFSC discussion channels; subscribes to ENISA + NCSC advisories.

N/A — single founder; no employees. Will adopt policy at first hire.

Acceptable-use embedded in founder operating procedure; will formalise at first hire.

Founder operates browser-only; no printed customer data; locked workspace when away.

Single home-office; disk-encrypted laptop; MFA on every privileged account.

N/A — no employees / no issued assets.

N/A — no employees yet.

N/A — no employees yet.

N/A — no employees yet. Sub-processor contracts cover equivalent obligations.

Founder role + successor role spec in `16_Successor_Role_Spec.md`. Second-operator brief in `17_Second_Operator_Brief.md`.

Mutual NDA template available; signed with every pilot prospect before sharing diligence pack.

Founder maintains CPD; will formalise programme at first hire.

Founder DPO-equivalent; maintains data-protection CPD.

Tenant user responsibilities documented in Pilot Agreement §4 and the in-product onboarding checklist.

Row-level security on every tenant table; least-privilege role model (admin / cco / mlro / board / user). See Trust Pack §4.

Supabase Auth password policy: min 12 chars, breach-list check via HIBP, no max length.

All identities in `auth.users` + `public.tenant_users`; operator review at `/admin/tenant-users`.

Maker-checker workflow on regulatory adoption; admin / cco / mlro / board roles separated. Row-level security on every tenant table; least-privilege role model (admin / cco / mlro / board / user). See Trust Pack §4.

Row-level security on every tenant table; least-privilege role model (admin / cco / mlro / board / user). See Trust Pack §4.

Tenant-admin invites + named roles; audit-trailed.

Role changes + offboarding via `/admin/tenant-users`; immediate effect; audit-trailed.

Quarterly access review prompt on `/admin/tenant-users`; results captured in audit trail.

`sandbox_admin` (founder cross-tenant) is separate from per-tenant `admin`.

Privileged roles grant logged in `user_roles` + audit-trailed; manual approval required.

Founder cross-tenant access is documented in Pilot Agreement §5; tenant can revoke at any time.

Append-only audit-trail with SHA-256 hash chain; per-page verifier at `regalign.app/verify`. See Trust Pack §6.

Every action stamped with `auth.uid()` + tenant; no shared accounts.

MFA-enforced for founder accounts (RegAlign + RiskAlign). MFA-enforced for tenant admins on roadmap (queued).

Supabase Auth; bcrypt-hashed; reset via verified email; no plaintext storage.

RLS + has_role() security-definer functions; documented in `architecture-overview.md`.

Documented data-export commitment in Pilot Agreement §9.

Public REST API v1 at `/api/public/v1/*`; contract PDF in `public/downloads/canonical/public-api-contract.pdf`.

API authenticated with bearer tokens; webhooks signed HMAC-SHA256.

Pilot Agreement §9 commits to CSV/JSON export of all tenant data on request, format documented in `public-api-contract.md`.

Infrastructure offloaded to Cloudflare Workers + Lovable Cloud (Supabase EU). RegAlign-side policy in `architecture-overview.md`.

Managed-platform auto-scale (Cloudflare Workers, Supabase). Capacity review at every architecture change.

Cloudflare WAF + DDoS protection; TLS-only ingress; egress to known sub-processors only.

N/A — no host OS managed by RegAlign. Workers + managed Postgres.

Separate Lovable preview + published environments; pilot/sandbox tenants flagged `live_PROHIBITED`.

Multi-tenant logical segregation via RLS; no shared schema for tenant data without `tenant_id` scoping.

N/A — cloud-native since inception; no on-prem migration.

Documented in `architecture-overview.md` and `data-model-map.md`.

Cloudflare WAF + bot mitigation; Sentry alerting on server errors; rate-limiting on `/api/public/*`.

Logging policy: every state-changing action audit-trailed; security events to Sentry. Append-only audit-trail with SHA-256 hash chain; per-page verifier at `regalign.app/verify`. See Trust Pack §6.

Append-only + SHA-256 hash chain (sealed). Tampering detectable at `/verify`.

Sentry (browser + server); founder receives alert on errors and suspicious patterns.

Audit-trail read scoped by RLS to tenant admins + sandbox_admin; every read is itself audit-trailed for privileged roles.

Founder reviews critical audit events daily; alerts via Sentry.

All timestamps from managed-platform NTP (Cloudflare, Supabase). UTC stored, UI localises.

Audit scope: auth events, role changes, data CRUD, exports, adoptions, escalations, attestation pack composition, key issuance/revocation.

Per-event record: actor (`auth.uid()`), tenant, entity, action, timestamp, prior-hash, current-hash.

Append-only audit-trail with SHA-256 hash chain; per-page verifier at `regalign.app/verify`. See Trust Pack §6.

TLS health monitored by Cloudflare; at-rest encryption status reported by Supabase. No internal crypto-monitoring dashboard yet.

Append-only audit-trail with SHA-256 hash chain; per-page verifier at `regalign.app/verify`. See Trust Pack §6.

Role grants/revocations + auth events captured in audit trail + Supabase Auth logs.

Sentry captures errors; weekly review by founder; high-severity alerts immediate.

Documented in BCP outline; 24h tenant notification SLA per Pilot Agreement §8.

Status page + incident comms via direct tenant-admin email.

IR plan in `07_BCP_Outline.md`; founder = on-call; successor role spec in `16_Successor_Role_Spec.md`.

Not yet tested live. Tabletop exercise scheduled Q3 2026.

Sentry MTTA/MTTR available; formal monthly metric report deferred.

Sentry severity → founder triage within 1 business hour during working hours.

DPJL 2018 / UK GDPR-aligned: 72h to JOIC, 24h to tenants. Documented in Pilot Agreement §8.

Security contact published at `regalign.app/vdp` and `regalign.app/trust`; tenant emergency contact captured at onboarding.

Shared-responsibility model documented in Trust Pack §3 and `architecture-overview.md`.

Public sub-processor list at `regalign.app/trust` and in `14_Sub_Processor_List.md`; changes notified 30 days in advance per Pilot Agreement §7.

Pilot Agreement §3 + Trust Pack §3 spell out what RegAlign vs the tenant is responsible for.

RACI documented in Trust Pack §3.

Reviewed at every release + every sub-processor change.

Controls implemented per Trust Pack §4-§7; evidence in `docs/canonical/`.

Public sub-processor list at `regalign.app/trust` and in `14_Sub_Processor_List.md`; changes notified 30 days in advance per Pilot Agreement §7.

Sub-processor risk reviewed before onboarding; certifications + region + SLAs captured in `14_Sub_Processor_List.md`.

Pilot Agreement scaffold at `05_Pilot_Agreement_Scaffold.md`.

Sub-processor contracts reviewed at renewal; security addenda in place where required.

Internal self-assessment (this document). External testing per AA-02.

Sub-processor SLAs monitored via status pages + Sentry.

Sub-processor list reviewed quarterly; changes notified 30 days in advance per Pilot Agreement §7.

Sub-processor security posture captured in `14_Sub_Processor_List.md`; only EU-region processors on data path.

Public VDP at `regalign.app/vdp`; remediation SLAs documented in `28_Vulnerability_Disclosure_Policy.md`.

N/A — no host OS managed by RegAlign; no user-uploaded executables; sub-processor anti-malware applies.

Critical: 7 days; High: 30 days; Medium: 90 days; Low: best-effort. Per `28_Vulnerability_Disclosure_Policy.md`.

Dependency-vulnerability scan in CI; managed-platform patching by sub-processors.

Dependency-scan on every build (npm audit + Lovable dependency scanner).

Continuous dependency scanning is real (Aikido + Lovable scanner on every build, see TVM-05). Independent human penetration test deferred until first paying pilot is signed; RFP drafted at docs/canonical/19_Pen_Test_RFP.md. Honest 'Partial' rather than 'No' — automated scanning is in production today.

Dependency scan in CI + VDP submissions + Sentry error patterns.

CVSS-aligned; remediation slotted per TVM-03 schedule.

Internal reporting only; formal report cadence deferred until first paying pilot.

MTTR captured per VDP submission; broader metric reporting deferred.

Founder laptop only — disk encryption (FileVault), screen lock, OS auto-update, MFA on every privileged login. Limited applicability — RegAlign has no employee fleet. Founder laptop only, with disk encryption + browser-only operator access. No MDM at this scale.

Founder approves all software/services in use; documented in operating procedure.

Browser-only operator surface; supported in modern Chromium/Firefox/Safari.

Single founder endpoint inventoried. Tenant endpoints out-of-scope (tenant-managed).

Manual management on single founder endpoint. Limited applicability — RegAlign has no employee fleet. Founder laptop only, with disk encryption + browser-only operator access. No MDM at this scale.

Founder laptop auto-locks after 5 min inactivity.

macOS current major release; auto-update enabled.

FileVault enabled on founder laptop.

macOS Gatekeeper + XProtect + System Integrity Protection.

macOS application firewall enabled.

Operator surface is browser-only; no bulk export from founder endpoint. Formal DLP tooling N/A at single-founder scale.

N/A — single founder endpoint; Find My Mac enabled for personal device recovery.

Find My Mac remote wipe enabled on founder laptop.

N/A — no third-party endpoints provisioned by RegAlign.