SOC 2 Readiness Roadmap

IMPORTANT: DuruVault is NOT SOC 2 certified and this document does not claim any certification, attestation, or audit opinion. It is an internal readiness roadmap describing current controls and the work required before any future SOC 2 examination.

1. Trust Services Criteria

A SOC 2 examination evaluates controls relevant to one or more Trust Services Criteria: Security (common criteria), Availability, Confidentiality, Processing Integrity, and Privacy. DuruVault's initial focus is Security, Confidentiality, and Privacy.

2. Controls Already in Place

Representative controls currently implemented (verified in the platform):

• Access control: role-based access, per-tenant data isolation, least-privilege human access.
• Authentication: bcrypt password hashing, multi-factor authentication, passkeys/WebAuthn, session expiry, brute-force lockout.
• Encryption: TLS in transit with HSTS; encrypted off-site disaster-recovery backups.
• Logging & monitoring: audit logs for security-relevant actions; webhook signature verification and idempotency.
• Resilience: managed-database backups plus an independent encrypted off-site backup (Backblaze B2) and a tested isolated restore procedure.
• Application security: hardened HTTP security headers and a restrictive Content-Security-Policy; signature-verified payment and identity webhooks.
• Incident response: documented process (see /legal/incident-response).

3. Gaps & Roadmap (pre-examination)

Work required before a SOC 2 Type I/II examination:

• Formalize written policies (information security, access, change management, vendor/subprocessor management, business continuity).
• Implement continuous control monitoring and alerting; formalize log retention.
• Complete vendor risk reviews for all subprocessors and verify provider attestations.
• Independent penetration testing and remediation tracking.
• Define the system description and control matrix; select an auditor; complete a Type I point-in-time review, then a Type II observation window (commonly 3–12 months).

4. Owner Actions

Engaging a qualified CPA/audit firm, funding penetration testing, and committing to the Type II observation period are owner decisions. No certification should be claimed in marketing, sales, or product surfaces until an auditor issues a report.