# Corvalon HRM: SIG-Lite Self-Assessment

Last updated: 2026-07-07

This is a completed **SIG-Lite** (Standardized Information Gathering, Lite edition) self-assessment, organized by the Shared Assessments SIG risk-control domains. It is a vendor self-attestation intended to support SMB security reviews. Answers describe controls **as currently implemented**.

> **Certification status.** Corvalon HRM has **not** completed a SOC 2 examination. A SOC 2 Type II engagement is in preparation; the observation window has not yet started. This document is a self-assessment offered as interim evidence, not an independent audit opinion. Full questionnaires and architecture reviews are supported under NDA.

**Legend:** Yes = control implemented / No = not implemented / Partial = implemented with a stated gap / N/A = not applicable.

---

## A -- Enterprise Risk Management

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| A.1 | Is there a documented information-security program? | Yes | Published Trust Center documentation set with policies for security, privacy, change management, and disclosure. |
| A.2 | Is a risk assessment performed on a recurring basis? | Yes | Continuous automated scanning plus periodic full platform audits (most recent 2026-07-01). |
| A.3 | Has an independent attestation (SOC 2 / ISO 27001) been completed? | No | SOC 2 Type II in preparation; observation window not started. |

## B -- Security Policy

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| B.1 | Are security policies documented and reviewed? | Yes | Security overview, privacy practices, change-management, and vulnerability-disclosure policies published and maintained. |
| B.2 | Are policies communicated to personnel? | Yes | Security training for developers plus annual security-awareness program. |

## C -- Organizational Security

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| C.1 | Are security responsibilities defined? | Yes | Defined security responsibilities with separation of duties encoded in the 17-role RBAC model. |
| C.2 | Is separation of duties enforced for sensitive operations? | Yes | Toxic-combination SoD matrix (SOX-06); payroll requires dual approval. Solo-founder-stage compensating controls documented in `Change_Management_Policy.md`. |

## D -- Asset & Information Management

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| D.1 | Is information classified by sensitivity? | Yes | Data classification (PII, PHI, financial) with field-level sensitivity tagging. |
| D.2 | Is a data inventory / data-flow understanding maintained? | Yes | Documented data model and sub-processor data-flow inventory. |

## E -- Human Resources Security

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| E.1 | Are background checks performed for staff with data access? | Yes | Background checks for personnel with data access. |
| E.2 | Is security-awareness training required? | Yes | Annual security-awareness program; developer security training. |

## F -- Physical & Environmental Security

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| F.1 | Are data centers physically secured? | Yes | Hosted entirely on AWS (SOC 2 / ISO certified data centers); no on-premises components. |
| F.2 | Is physical access to infrastructure restricted? | N/A | Inherited from AWS; Corvalon operates no physical facilities processing customer data. |

## G -- IT Operations Management

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| G.1 | Are systems patched on a defined cadence? | Yes | Automated OS and dependency updates; weekly dependency and container scans. |
| G.2 | Is capacity and availability monitored? | Yes | CloudWatch metrics/alarms; per-environment ECS task counts. Load-based auto-scaling on the roadmap. |
| G.3 | Are backups performed, encrypted, and recoverable? | Yes | Daily encrypted RDS backups, 30-day PITR, cross-region snapshot copies. |

## H -- Access Control

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| H.1 | Is access granted on a least-privilege basis? | Yes | 17-role RBAC with DB-derived, provisioned permissions and field-level restrictions. |
| H.2 | Is multi-factor authentication enforced for privileged access? | Yes | TOTP + WebAuthn/FIDO2; required for 10 of 17 roles including all admin roles. |
| H.3 | Are strong password controls enforced? | Yes | Argon2id hashing; account lockout after 5 failed attempts (30-minute lockout); no user/tenant enumeration on login failure. |
| H.4 | Is access reviewed and revoked promptly? | Yes | Immediate session/token revocation on deactivation; server-side sliding idle timeout (default 15 min); periodic access-review reporting. |
| H.5 | Is federated SSO supported? | Yes | OIDC (5 IdP types) and SAML 2.0 with signature validation; SCIM 2.0 provisioning. |

## I -- Application Security

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| I.1 | Is a secure development lifecycle followed? | Yes | TDD (tests first), PR review, pre-commit lint/coverage hooks, SAST/DAST/dependency/container gates in CI. |
| I.2 | Are OWASP Top 10 risks mitigated? | Yes | Parameterized SQL, input validation, CSRF tokens, nonce-based CSP (SEC-02), rate limiting, output encoding. |
| I.3 | Is customer data logically segregated in multi-tenant architecture? | Yes | Schema-per-tenant plus PostgreSQL RLS as a second isolation layer; per-tenant encryption context. |
| I.4 | Is an audit trail of application activity maintained and protected? | Yes | Append-only 7-year audit trail; completeness enforced by a DB backstop trigger (SOX-02); tamper-evidence via a hash chain verified daily (SOX-08). |

## J -- Cybersecurity Incident Management

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| J.1 | Is there a documented incident-response plan? | Yes | Documented detection-through-postmortem IR process; triage severity within 1 hour. |
| J.2 | Are customers notified of incidents within a defined window? | Yes | Within 72 hours per GDPR (sooner when possible). |
| J.3 | Is a coordinated vulnerability-disclosure program offered? | Yes | `security@corvalonhrm.com` with safe-harbor terms. |

## K -- Operational Resilience / Business Continuity

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| K.1 | Is there a documented BC/DR plan with RTO/RPO? | Yes | DR runbook with defined RTO/RPO; RDS Multi-AZ failover in production. |
| K.2 | Are recovery tests performed? | Partial | Quarterly restore drills scheduled; first drill not yet executed. |

## L -- Compliance & Privacy

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| L.1 | Are applicable privacy regulations addressed? | Yes | GDPR, CCPA/CPRA, VCDPA/CPA/CTDPA and emerging US state laws; DSR portal for access/correction/deletion/portability. |
| L.2 | Are Data Processing Agreements and transfer mechanisms available? | Yes | DPA template, SCC, UK IDTA, and Transfer Impact Assessment published. |
| L.3 | Is customer data used to train AI models? | No | Never used for model training; AI output redaction and per-user opt-out enforced at the gateway. |

## M -- Threat & Vulnerability Management

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| M.1 | Is vulnerability scanning continuous? | Yes | Dependabot, govulncheck, Semgrep, Trivy, and OWASP ZAP on every PR / weekly. |
| M.2 | Has an independent penetration test been performed? | No | Planned pre-launch; annual cadence thereafter. |
| M.3 | Are remediation SLAs defined by severity? | Yes | Critical 24h, High 7d, Medium 30d, Low 90d. |

## N -- Encryption & Key Management

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| N.1 | Is data encrypted at rest and in transit? | Yes | AES-256 at rest (RDS), TLS 1.2+ in transit, Vault Transit field-level encryption for SSN/bank/EIN/MFA. |
| N.2 | Is key management performed securely with tenant separation? | Yes | HashiCorp Vault with KMS auto-unseal; per-tenant key derivation; optional tiered per-tenant keys for crypto-deletion. |
| N.3 | Are application and SSO secrets encrypted? | Yes | OIDC client secrets Vault-encrypted, fail-closed on deployed environments (SEC-01); other secrets in SSM/Vault. |

## V -- Supply Chain / Fourth-Party Management

| Ref | Question | Response | Notes |
|-----|----------|----------|-------|
| V.1 | Is a sub-processor inventory maintained and disclosed? | Yes | Published sub-processor list (AWS, Vault, Anthropic, Sentry) with data-flow detail. |
| V.2 | Are customers notified before a sub-processor change? | Yes | 30-day advance notice; customers may object per the DPA. |
| V.3 | Are sub-processors security-assessed? | Yes | Vendor assessment and annual security reviews. |

---

## Summary of Known Gaps (Interim Status)

Disclosed honestly and tracked on the launch roadmap:

- SOC 2 Type II examination (in preparation; observation window not started).
- Independent penetration test (planned pre-launch).
- First DR restore-drill execution (scheduled; not yet executed).
- Load-based auto-scaling and Redis replication (roadmap).
- Input-side AI PII stripping (output-side redaction already enforced).

---

## Contact

- **Security / questionnaires:** security@corvalonhrm.com
- **Compliance:** compliance@corvalonhrm.com
- **Trust Center:** [https://corvalonhrm.com/trust](https://corvalonhrm.com/trust)