# Corvalon HRM: CAIQ-Lite Self-Assessment

Last updated: 2026-07-07

This is a completed **CAIQ-Lite** (Consensus Assessments Initiative Questionnaire, Lite edition) self-assessment based on the Cloud Security Alliance Cloud Controls Matrix (CCM v4). It is a vendor self-attestation intended to support SMB security reviews. Answers describe controls **as currently implemented**.

> **Certification status.** Corvalon HRM has **not** completed a SOC 2 examination. A SOC 2 Type II engagement is in preparation; the observation window has not yet started. Nothing in this document should be read as an independent audit opinion or certification. This is a self-assessment offered as interim evidence. Questionnaires and architecture reviews are supported under NDA.

**Legend:** Yes = control implemented / No = not implemented / Partial = implemented with a stated gap or roadmap item / N/A = not applicable to this service model.

---

## A&A -- Audit & Assurance

| # | Question | Response | Notes |
|---|----------|----------|-------|
| A&A-01 | Do you maintain audit-readiness documentation mapped to a recognized framework? | Yes | SOC 2 Trust Service Criteria controls mapping maintained (`SOC2_Controls_Mapping.md`), covering all five TSC categories. |
| A&A-02 | Have you completed an independent third-party audit (e.g., SOC 2)? | No | SOC 2 Type II in preparation; observation window not yet started. No report exists today. |
| A&A-03 | Do you support customer security reviews and questionnaires? | Yes | Supported under NDA, including architecture walkthroughs and this CAIQ-Lite / SIG-Lite package. |
| A&A-04 | Is an internal audit / control self-assessment performed? | Yes | Periodic internal platform audits; most recent full audit 2026-07-01 (`Documents/audit/Full_Audit_2026-07-01.md`). |

## AIS -- Application & Interface Security

| # | Question | Response | Notes |
|---|----------|----------|-------|
| AIS-01 | Are applications developed following a secure SDLC? | Yes | PR review, automated test gates, SAST/DAST/dependency/container scanning on every PR. Tests are written before implementation (TDD) and coverage is enforced by a pre-commit hook. |
| AIS-02 | Is input validated on both client and server? | Yes | Zod schema validation (frontend), Go struct validation (backend), parameterized SQL only. |
| AIS-03 | Are APIs authenticated and authorized? | Yes | REST API with JWT-based auth, RBAC permission checks, and field-level security derived from JWT claims. |
| AIS-04 | Is a Content-Security-Policy enforced? | Yes | Per-request nonce-based CSP on all four web front ends (SEC-02); `unsafe-inline` removed from `script-src`. |

## BCR -- Business Continuity & Operational Resilience

| # | Question | Response | Notes |
|---|----------|----------|-------|
| BCR-01 | Are automated backups performed and encrypted? | Yes | Daily automated RDS backups (AES-256), 30-day point-in-time recovery, AWS Backup snapshots (90-day daily / 365-day monthly) with cross-region copy. |
| BCR-02 | Is there a documented disaster-recovery plan with RTO/RPO? | Yes | Documented DR runbook with defined RTO/RPO. |
| BCR-03 | Are recovery/restore tests performed? | Partial | Quarterly restore drills scheduled on the operational calendar; first drill not yet executed. |
| BCR-04 | Is the database deployed for high availability? | Yes | RDS Multi-AZ with automatic failover (production). |

## CCC -- Change Control & Configuration Management

| # | Question | Response | Notes |
|---|----------|----------|-------|
| CCC-01 | Are all changes authorized, tested, and reviewed before deployment? | Yes | PR-based workflow, automated test gates, per-change backlog item / decision record, GitHub Environment reviewer gate on prod and Terraform apply. Documented in `Change_Management_Policy.md` (SOX-03). |
| CCC-02 | Is infrastructure managed as code? | Yes | Terraform modules per environment; `terraform plan` runs under a read-only IAM role on every infra PR. |
| CCC-03 | Are production deployments separated from development? | Yes | Four-tier environments (local / dev / stage / prod), each an isolated VPC. |

## CEK -- Cryptography, Encryption & Key Management

| # | Question | Response | Notes |
|---|----------|----------|-------|
| CEK-01 | Is data encrypted at rest? | Yes | RDS AES-256 at rest; sensitive fields (SSN, bank, EIN, MFA secrets) additionally encrypted via HashiCorp Vault Transit before storage. |
| CEK-02 | Is data encrypted in transit? | Yes | TLS 1.2+ on all external connections; TLS between internal components including the ALB-to-container leg. |
| CEK-03 | Is per-tenant cryptographic separation used? | Yes | Vault Transit key derivation uses tenant context; a tiered per-tenant key scheme enabling crypto-deletion on offboarding is available behind a config flag. |
| CEK-04 | Are application/SSO secrets protected? | Yes | OIDC client secrets encrypted via Vault Transit; the encryptor fails closed on stage/production if no Vault client is configured (SEC-01). Other secrets in AWS SSM Parameter Store or Vault. |

## DSP -- Data Security & Privacy Lifecycle Management

| # | Question | Response | Notes |
|---|----------|----------|-------|
| DSP-01 | Is customer data logically isolated between tenants? | Yes | Schema-per-tenant (`t_<slug>`, ~303 tables each) plus PostgreSQL row-level security as a defense-in-depth second layer. |
| DSP-02 | Are data-retention and disposal policies enforced? | Yes | Configurable retention (90 days to 7 years by category); audit-log purge runs under a dedicated least-privilege role and is archive-gated (SEC-09). |
| DSP-03 | Are data-subject requests (access/correction/deletion/portability) supported? | Yes | DSR portal with audit trail; legal-hold check before erasure. |
| DSP-04 | Is customer data used to train AI models? | No | Customer data is never used to train models; commercial AI API terms exclude API data from training. AI output redaction and per-user opt-out enforced at the gateway. |
| DSP-05 | Is sensitive data masked based on role? | Yes | Field-level security enforced in the Go backend (authoritative); frontend mirrors for UX. |

## GRC -- Governance, Risk & Compliance

| # | Question | Response | Notes |
|---|----------|----------|-------|
| GRC-01 | Are information-security policies documented and maintained? | Yes | Trust Center documentation set: security overview, privacy practices, change management, vulnerability disclosure, DPA, sub-processor list. |
| GRC-02 | Is a risk assessment performed? | Yes | Continuous DAST/SAST, CVSS-based severity classification, documented remediation SLAs. |
| GRC-03 | Are regulatory obligations tracked (GDPR, CCPA/CPRA, US state privacy)? | Yes | GDPR, CCPA/CPRA, VCDPA/CPA/CTDPA and emerging state laws; cross-border transfer documentation (SCC, UK IDTA, TIA). |

## HRS -- Human Resources Security

| # | Question | Response | Notes |
|---|----------|----------|-------|
| HRS-01 | Are background checks performed for personnel with data access? | Yes | Background checks for personnel with data access. |
| HRS-02 | Is security-awareness training provided? | Yes | Security training for developers and annual security awareness program. |
| HRS-03 | Is separation of duties enforced? | Yes | Separation of duties across 17 RBAC roles; toxic-combination analysis in the SoD permissions matrix (SOX-06). As a solo-founder-stage vendor, documented compensating controls apply (`Change_Management_Policy.md`). |

## IAM -- Identity & Access Management

| # | Question | Response | Notes |
|---|----------|----------|-------|
| IAM-01 | Is multi-factor authentication supported and enforced for privileged access? | Yes | TOTP and WebAuthn/FIDO2; MFA required for 10 of 17 roles including all admin roles. |
| IAM-02 | Are passwords stored using a strong hashing algorithm? | Yes | Argon2id (legacy bcrypt migration supported). |
| IAM-03 | Is role-based access control implemented with least privilege? | Yes | 17 roles, DB-derived + provisioned permissions, field-level restrictions. |
| IAM-04 | Is SSO / federated identity supported? | Yes | OIDC (Okta, Entra, Google, Auth0, generic) and SAML 2.0 with signature validation; SCIM 2.0 provisioning. |
| IAM-05 | Is access revoked promptly on deactivation? | Yes | Immediate session invalidation and token revocation on user deactivation; sliding idle-timeout (default 15 min) enforced server-side. |

## IVS -- Infrastructure & Virtualization Security

| # | Question | Response | Notes |
|---|----------|----------|-------|
| IVS-01 | Is network segmentation enforced? | Yes | Dedicated VPC per environment; data-tier services (DB, Vault, Redis) are not internet-reachable, protected by least-privilege security-group chains. |
| IVS-02 | Are container images scanned for vulnerabilities? | Yes | Trivy container scanning on every PR and weekly. |
| IVS-03 | Are secrets kept out of source and images? | Yes | No hardcoded secrets; credentials in SSM Parameter Store or Vault, injected as environment/ECS secrets. |

## LOG -- Logging & Monitoring

| # | Question | Response | Notes |
|---|----------|----------|-------|
| LOG-01 | Is an immutable audit trail maintained for all mutations? | Yes | Append-only audit trail, 7-year retention. A database backstop trigger records mutations even if an application call site omits its explicit audit write, enforcing completeness at a single chokepoint (SOX-02). |
| LOG-02 | Is the audit trail tamper-evident? | Yes | `audit_log` rows are hash-chained (`prev_hash`/`row_hash`); a daily worker cron verifies the live and archived chains and emits verification metrics (SOX-08). |
| LOG-03 | Are infrastructure and application metrics monitored with alerting? | Yes | CloudWatch metrics/alarms, Prometheus metrics, OpenTelemetry tracing, SNS alerting. |

## SEF -- Security Incident Management

| # | Question | Response | Notes |
|---|----------|----------|-------|
| SEF-01 | Is there a documented incident-response process? | Yes | Detection, triage (severity within 1 hour), containment, investigation, remediation per SLA, notification, blameless postmortem. |
| SEF-02 | Are affected customers notified of breaches within a defined window? | Yes | Within 72 hours per GDPR (sooner when possible). |
| SEF-03 | Is a vulnerability disclosure channel published? | Yes | `security@corvalonhrm.com` with safe-harbor for responsible disclosure (`Vulnerability_Disclosure_Policy.md`). |

## STA -- Supply Chain, Transparency & Accountability

| # | Question | Response | Notes |
|---|----------|----------|-------|
| STA-01 | Is a sub-processor list maintained and are customers notified of changes? | Yes | Published sub-processor list; 30-day advance notice before adding a sub-processor. |
| STA-02 | Are Data Processing Agreements available? | Yes | DPA template published; SCC, UK IDTA, and Transfer Impact Assessment available for cross-border transfers. |
| STA-03 | Are sub-processors assessed for security? | Yes | Vendor assessment for sub-processors, annual vendor security reviews. |

## TVM -- Threat & Vulnerability Management

| # | Question | Response | Notes |
|---|----------|----------|-------|
| TVM-01 | Is dependency and code scanning continuous? | Yes | Dependabot, govulncheck, Semgrep (SAST) on every PR and weekly. |
| TVM-02 | Is dynamic application security testing performed? | Yes | OWASP ZAP baseline on every push plus scheduled full scan. |
| TVM-03 | Has a third-party penetration test been performed? | No | External penetration test planned pre-launch (none performed yet); annual cadence thereafter. |
| TVM-04 | Are remediation SLAs defined by severity? | Yes | Critical 24h, High 7d, Medium 30d, Low 90d. |

---

## Summary of Known Gaps (Interim Status)

The following items are honestly disclosed as not-yet-complete and are tracked on the launch roadmap:

- SOC 2 Type II examination (in preparation; observation window not started).
- Third-party penetration test (planned pre-launch).
- First DR restore drill execution (scheduled; not yet executed).
- Load-based auto-scaling and Redis replication (on the roadmap).
- Input-side AI PII stripping (output-side redaction already enforced).

---

## Contact

- **Security / questionnaires:** security@corvalonhrm.com
- **Compliance:** compliance@corvalonhrm.com
- **Trust Center:** [https://corvalonhrm.com/trust](https://corvalonhrm.com/trust)