SCOPE: everything in progressdocs/compliance/vendors-and-counsel.md · build 40bb41bdb460

Platform, auditor, pen test, counsel

The items that need somebody outside the team, with what to send them. Drafted 27 Oct 2026. Nothing has been sent.

Compliance platform (ORG-04, ORG-05)

Ask three of Vanta, Drata, Secureframe and Sprinto for a quote. Decision: Kyle and Dan.

Quote request (to send from a Lucent Axis address):

We are a small software company (two engineers, plus contractors) preparing SCOPE, a workplace-safety platform, for a SOC 2 Type I covering Security, Confidentiality and Availability in about four months, followed by a Type II. Our stack: GitHub (Team), Vercel, Supabase, Google Workspace, all staff on personal laptops. Please quote for: the platform for one year, the partner auditor's Type I and Type II fees, policy templates, security awareness training, the device agent for personal laptops (Mac and Windows), background checks, and a pen test if you resell one. Please confirm you integrate with Supabase and Vercel.

Compare on:

Platform A Platform B Platform C
Year-one price (platform)
Auditor Type I + Type II
Supabase integration
Vercel integration
Device agent works on personal laptops without full MDM
Pen test included or resold
Trust page included (NP-7)
Contract length, exit terms

ORG-05 follows the choice and Step 0: connect the Lucent Axis GitHub org, Vercel team, Supabase org and Google Workspace. Never connect a personal account.

Auditor (ORG-12, ORG-29, ORG-30)

The platform's partner, or a CPA firm hired directly (Free first). Once chosen, ask in writing (ORG-12):

Our first production data before go-live will be realistic synthetic data in a production environment separate from our demo. Will the period in which controls operate over that environment count toward our Type II observation window?

Then book Type I fieldwork for month 4 (ORG-29) and put the Type II window start (the day after the Type I date, three to six months) in the calendar (ORG-30). Owner: Kyle.

Pen test (LM-4, ORG-27)

Decided 28 Oct. For the Type I: an automated scan (OWASP ZAP) of a staging deployment, plus the RLS proofs (scripts/db/verify_*.sql, run as real logins). A third-party pen test before the first enterprise client goes live. Owner: Kyle. Scope to send the tester (the scan covers the same ground where a scan can):

  • The SCOPE web app on a staging deployment with synthetic data, never the demo database
  • Four personas (driver, supervisor, GM, VP) plus an unauthenticated tester, so the test covers one role reaching another's records
  • The Supabase API directly with each persona's token: row-level security is the main wall (DB-1, DB-2), so this is where testing pays
  • File storage: signed links, bucket policies, upload checks
  • Out of scope: Supabase's and Vercel's own infrastructure

Deliverables: a findings report, a retest of highs and criticals after our fixes, and a summary letter we can share with customers (NP-7).

Counsel (ORG-36, VN-5, ORG-08)

Who: [Kyle or Business lead to name counsel]. Brief to send:

1. Data processing agreement (VN-5). For SCOPE customers. Must cover: our role (processor), the subprocessor list and the notice period for changes (subprocessors.md), data location (US), security measures (point to the SOC 2 report), breach notice within a window we can meet (the incident plan assumes 24 to 72 hours: counsel to pick), customer audit rights (satisfied by the SOC 2 report), deletion or return at contract end, the 5-year OSHA record retention, and support access by our staff (ID-6).

2. Contractor agreement clauses (ORG-08). Confidentiality; follow our security policies and the BYOD policy; report a security incident or a lost laptop at once, and within 1 hour of noticing; no customer data on personal storage or in AI tools; return and delete everything at the end and confirm in writing; background check consent where production access is given.

3. Contract terms for availability (NP-6). An uptime commitment only once measured, support hours, after-hours response time, and the RPO and RTO from the BC/DR plan only once a restore test has met them.

Novvia: is a Type I enough to go live? (ORG-34)

Added 28 Oct. Kyle to send to Novvia's security or procurement contact:

We are preparing SCOPE for a SOC 2 audit covering Security, Confidentiality and Availability. Our plan is a Type I report (controls designed and in place on a stated date) about four months from now, followed by a Type II (controls operating over three to six months). For your go-live, would you accept the Type I report plus a bridge letter from us covering the time until the Type II report is issued? If not, what would you need to see before go-live, and is there a security questionnaire you would like us to complete in the meantime?

The answer sets the order of the work: if Novvia needs the Type II before go-live, the Type II window (ORG-30) has to start as soon as the Type I is issued, so ORG-04 cannot wait.

COFI in the boundary (ORG-35)

Added 28 Oct. Decision for Dan and Kyle, no message to send. The default, stated in the system inventory: COFI (/cofi, the financial dashboards) stays OUT of the audit until a COFI client asks for it. What changes if it comes in: every financial table joins the confidentiality controls, the system description grows a section, and a buyer may then ask for SOC 1 as well, because COFI touches financial reporting. Write the decision here with the date; until then, the default stands.

Cyber insurance (ORG-31)

Question for the Business lead to put to the broker: does Lucent Axis carry cyber liability cover, what is the limit, does it cover a breach of customer data held in SCOPE, and does it require any controls (MFA, backups) we should match? Customers' security questionnaires usually ask for the limit.

Back to top