Security posture
21 controls по domain
Single-source-of-truth для procurement, legal и infosec stakeholders, оценивающих SLAtech. Каждый control помечен Implemented, Enterprise tier или Target quarter. Сообщать о vulnerabilities на [email protected].
Compliance
4 controls
| Control | Status |
|---|---|
| GDPR — DSR portal, DPA по запросу, SCC 2021/914 | Implemented |
| HIPAA — BAA-eligible single-tenant deployment | Enterprise tier |
| SOC 2 Type I report | Q3 2026 target |
| ISO 27001 certification | Q4 2026 target |
Data protection
4 controls
| Control | Status |
|---|---|
| AES-256-GCM at rest, TLS 1.2+ в transit | Implemented |
| Multi-tenant logical isolation на всех stores | Implemented |
| PHI / PII редактор на ingest (Med + Legal) | Implemented |
| EU-only residency (Microsoft Azure West/North Europe) | Implemented |
Identity
4 controls
| Control | Status |
|---|---|
| Argon2id password hashing, конфигурируемая per-tenant password policy | Implemented |
| SAML SSO integration | Enterprise tier |
| Role-based access control (RBAC) с per-tenant ролями | Implemented |
| Audit log админ-действий | Implemented |
Network
3 controls
| Control | Status |
|---|---|
| TLS 1.2+ enforced на каждом endpoint; HSTS preload | Implemented |
| Cloudflare WAF перед каждым хостом | Implemented |
| Per-tenant API rate limiting (60-6000 RPM по tier) | Implemented |
Operations
3 controls
| Control | Status |
|---|---|
| GitOps deploy pipeline (audited via GitHub Actions) | Implemented |
| Pre-deploy smoke tests + post-deploy QA harness | Implemented |
| Database backups (daily, 35-day retention) | Implemented |
Vulnerability
3 controls
| Control | Status |
|---|---|
| Dependabot — автоматические обновления зависимостей | Implemented |
| GitHub CodeQL статический анализ на каждом PR | Implemented |
| External penetration test (annual) | Q4 2026 target |