Standards readiness review¶

Status: Current | Last reviewed: 2026-08-30

This review assesses TrueServe against SOC 2, HIPAA, GDPR, PCI DSS, FedRAMP High, CCPA, CSA STAR, ISO/IEC 27001, and ISO/IEC 42001. Read it before making a compliance claim, selecting a regulated deployment profile, or planning assurance work.

Warning: This source-code and documentation review provides planning input. Ask counsel and the applicable independent assessor to validate the deployed environment, operating evidence, contracts, and organizational controls before you make a compliance claim.

Decision¶

Do not describe the current stack as compliant with all nine standards. The repository now implements the principal code and deployable architecture controls in the compliance implementation guide, but no reviewed evidence establishes a complete operating control system or external assurance result for any program.

Use these conclusions for planning:

Standard	Current readiness	Conditional path
SOC 2	Engineering baseline implemented	Operate the controls, assign owners, collect evidence, close live-environment findings, and complete the chosen CPA examination.
HIPAA	Technical profile implemented, not activated	Deploy and verify the PHI boundary, execute the BAA chain, complete risk analysis and policy work, train personnel, and validate safeguards.
GDPR	EU profile and rights workflow implemented	Complete role, notice, DPA, transfer, DPIA, processor, breach, and operating-evidence work for the real processing context.
PCI DSS 4.0.1	Segmented boundary implemented in code	Deploy the boundary, confirm every capture and recording path, obtain provider AOCs, and let the acquirer or QSA fix scope and validation.
FedRAMP High	Planning code only	Build the separate GovCloud Class D boundary, revalidate exact services and models, assess it, obtain authorization, and operate continuous monitoring.
CCPA	US profile and rights workflow implemented	Complete applicability, notices, GPC intake, sensitive-data, contract, appeal, non-discrimination, risk/cyber-audit, and operating work.
CSA STAR	Technical mapping implemented	Complete the current CCM/CAIQ and chosen Level 1 or Level 2 assurance process with operating evidence.
ISO/IEC 27001	Technical control baseline implemented	Establish and operate the ISMS, risk treatment, Statement of Applicability, internal audit, management review, corrective action, and certification process.
ISO/IEC 42001	AI release governance implemented	Establish and operate the AIMS around the technical inventory, risk, evaluation, approval, oversight, incident, and improvement controls.

Cloud and model-provider certifications support inherited controls. They do not certify TrueServe or give a customer an authorization to operate.

The code review state and the assurance state are deliberately separate. compliance/controls/catalog.yaml marks each cross-framework control as implemented, mixed, external, or planned. A tenant profile can activate only after a verified deployment manifest pins its exact hash and proves every required application control.

Scope and method¶

The review covers application code, schemas, Helm configuration, AWS Terraform, deployment documentation, security scanning, authentication, payment capture, data lifecycle, telemetry, and AI-provider configuration present on 2026-08-30. It uses repository evidence and current primary sources.

The review does not include:

a live AWS account, Kubernetes cluster, identity provider, DNS, network, logging backend, backup, or disaster-recovery test;
production samples, tickets, approvals, training records, vendor contracts, BAAs, DPAs, penetration tests, vulnerability reports, or incident exercises;
interviews with control owners or observation over an audit period;
legal determinations about role, jurisdiction, data category, CCPA thresholds, or the correct PCI self-assessment questionnaire.

A missing artifact means not evidenced. A customer may hold that artifact outside the repository. Treat a documented future phase as incomplete.

Existing control foundation¶

Area	Repository evidence	Assessment
Tenant isolation	Multi-tenancy documents `tenant_id` keys, PostgreSQL RLS, transaction-scoped tenant context, and per-tenant integration secrets.	Useful preventive control; privileged administration, service roles, and bypass paths still need operating tests and review evidence.
Route authorization	The route audit scans 433 handlers and reports every handler has an authorization classification. Route authentication documents wrapper and allowlist behavior.	Strong coverage check; its text-scan fallback is not a substitute for runtime authorization testing.
Customer authentication	Customer Authentication control mapping maps WebAuthn, OTP lockout, RLS, and append-only authentication events to code and tests.	Strong capability-specific evidence; it does not establish platform-wide compliance.
Secret protection	Secret storage documents purpose-bound KMS data-key envelopes, exact tenant contexts, FIPS SDK selection, legacy migration, and hashed API tokens.	Implemented for regulated application secrets; live KMS policy, rotation, access review, and cryptographic-boundary evidence still require verification.
Transport and segmentation	The regulated Helm overlay requires strict service-mesh mTLS, authorization policy, restricted pods, and default-deny network policy with explicit private egress CIDRs.	Implemented as a deployment gate; runtime conformance and segmentation tests remain environment evidence.
Managed secrets	Secrets management documents AWS Secrets Manager/SSM through External Secrets Operator.	Good pattern; access, rotation, replication, recovery, and audit evidence remain environment controls.
AI change traceability	AI governance requires inventory, risk approval, passing exact-artifact evaluation, independent expiring approval, guardrails, and immutable publish/runtime pins.	Technical release gate is implemented; AIMS operation, monitoring criteria, supplier review, incidents, audit, and management review remain organizational work.
Payment minimization	Payments and the dedicated vault keep PAN out of models, transcripts, recordings, general logs, and the platform database while preserving tokenized transaction evidence.	Technical boundary is implemented; an acquirer or QSA must confirm scope, deployment, provider evidence, scans, tests, and the applicable assessment route.
Audit and telemetry	Hash-chained compliance events, the operational audit bridge, chain verifier, delivery leases, and KMS-encrypted S3 Object Lock exporter complement OpenTelemetry and cloud detections.	Technical evidence path is implemented; alert operation, SIEM integration, access review, investigation samples, and retention verification remain live controls.

Required deployment profiles¶

Do not expose a single “compliance mode.” Publish a versioned profile with prohibited options, required infrastructure, evidence checks, and an owner.

Commercial regulated AWS¶

Use this profile for a SOC 2, HIPAA, GDPR/CCPA, CSA STAR, or ISO scope when federal High authorization is not required.

Isolate production accounts, networks, clusters, identities, keys, logs, backups, and administrative access.
Use only services and regions covered by the required AWS programs. For PHI, execute the AWS BAA and permit ePHI only in HIPAA-eligible services.
Require customer-managed KMS keys where the risk treatment requires separation, controlled rotation, or cryptographic erasure. Encrypt every database, cache, queue, object, snapshot, log, and backup.
Restrict AI, speech, telephony, analytics, and support providers through a profile allowlist. Require the appropriate BAA/DPA and validate data-use, retention, region, and subprocessors for each provider and model path.
Default recording, transcript, message, archive, search-index, backup, and log retention. Apply deletion across live stores, object versions, archives, caches, search, and downstream processors.
Make workload hardening, resilient data services, centralized security telemetry, periodic scanning, restoration tests, and incident exercises release gates.

AWS describes Amazon Bedrock as in scope for several AWS assurance programs and HIPAA eligible, but eligibility varies by feature, region, and model. AWS states that model providers cannot access prompts or completions and that customer content is not used to improve base models. Confirm the current service terms and scope at deployment time.

PCI-segmented payment boundary¶

Scope payment capture as a separate cardholder-data environment. Keep the general platform outside the PCI claim unless the assessor includes it.

Finish and validate every open control in Payments, especially chat entry, upstream recorder suppression, browser capture, webhooks, settlement, and credential/key operations.
Give the vault a dedicated account or a boundary that the assessor accepts as equivalent, private networking, a dedicated database role, hardened non-root workloads, limited egress, tamper-evident logs, and independent scanning.
Prefer a PCI DSS-compliant hosted payment page or iframe where business requirements permit. Let the acquirer or QSA determine SAQ A, SAQ A-EP, or a broader scope; the architecture name does not determine eligibility.
Obtain service-provider attestations, complete the applicable assessment, ASV scans where required, penetration testing, training, incident procedures, and evidence retention.

FedRAMP High boundary¶

Build a distinct AWS GovCloud (US) deployment and authorization boundary. FedRAMP and AWS now describe the former High baseline as Class D; customer contracts may still say “FedRAMP High.”

Replace commercial-partition assumptions such as arn:aws: with partition-aware Terraform. The current production stack is not a GovCloud deployment profile.
Permit only services, features, regions, endpoints, cryptography, and exact model versions that are in the applicable AWS FedRAMP scope. A Bedrock service authorization does not extend to every Bedrock model.
Start with a minimal product boundary, such as text-only. The repository has AWS Transcribe support, but the current standard TTS/provider path does not establish an all-FedRAMP voice chain. The AWS Bedrock FedRAMP model table, updated 2026-08-25, does not list Amazon Nova Sonic in the GovCloud Class D column.
Remove non-authorized external AI, speech, telephony, observability, support, and update paths. Control build systems, images, registries, administrators, and support personnel within the boundary and applicable personnel requirements.
Implement the selected NIST SP 800-53 High/Class D baseline and overlays, FIPS-validated cryptography requirements, configuration baselines, supply-chain controls, incident reporting, vulnerability remediation, continuous monitoring, and evidence automation.
Produce the boundary, inventory, data flows, control implementation statements, policies, procedures, SSP, SAP/SAR, POA&M, contingency evidence, interconnections, and customer responsibility matrix. Engage a recognized independent assessor and sponsoring/authorizing agency early.

AWS authorization is inherited only for AWS-responsible controls. It does not grant TrueServe or its customer an authorization to operate.

EU and California privacy profile¶

Apply this profile in addition to a commercial or federal security profile. Base California applicability decisions on the CCPA statute and regulations effective 2026-01-01.

Fix controller, processor, service-provider/contractor, and subprocessor roles in contract and system metadata.
Enforce purpose, legal basis, notice version, consent or opt-out state, regional routing, minimization, and retention by data category.
Implement verified access/know, portability, correction, deletion, appeal/escalation, sale/share opt-out, Global Privacy Control, sensitive-data limitation, and non-discrimination workflows as applicable.
Produce a data inventory, records of processing, DPIAs/risk assessments, transfer mechanism and impact assessment, processor agreements, request evidence, and breach workflow.

Framework-specific acceptance gates¶

Standard	Minimum evidence before an external claim
SOC 2	Defined system and service commitments; mapped controls; owners; policies; risk assessment; vendor management; incident/BCP testing; access/change/vulnerability evidence; CPA Type I or Type II report.
HIPAA	Role determination; BAA chain; security risk analysis; risk-management plan; policies and training; access, audit, integrity, transmission, contingency, incident, and breach controls; periodic evaluation.
GDPR	Data inventory and roles; Article 28 terms; Article 32 measures; records of processing; rights operations; privacy notices; retention; DPIAs where required; international-transfer controls; breach process.
PCI DSS	Confirmed scope and data flows; segmentation validation; all applicable PCI DSS 4.0.1 requirements; service-provider AOCs; required scans/tests; applicable SAQ/AOC or ROC completed by the proper party.
FedRAMP High	GovCloud/Class D boundary; complete package; implemented controls; assessor report; resolved or accepted POA&M; authorization decision; continuous-monitoring operations.
CCPA	Applicability analysis; notices; contracts; verified rights; deletion across processors; opt-out/GPC; sensitive-data limits; request metrics; applicable risk assessment, cyber audit, and ADMT controls.
CSA STAR	Completed current CCM/CAIQ and public Level 1 submission, or a valid Level 2 certification/attestation with the corresponding scope and evidence.
ISO/IEC 27001	Operating ISMS; context/scope; leadership; risk method/results; Statement of Applicability; objectives; competence; operational controls; internal audit; management review; corrective action; certification audit.
ISO/IEC 42001	Operating AIMS; AI policy/scope; role and use-case inventory; impact/risk assessment; data and model governance; supplier controls; lifecycle/evaluation records; transparency/human oversight; incident and improvement evidence; certification audit if claimed.

Remaining assurance roadmap¶

Before the first regulated tenant¶

Approve the intended claim, legal entity, boundary, data categories, jurisdiction, control owners, customer responsibilities, retention, recovery objectives, and provider contracts.
Deploy the regulated AWS stack and complete every verification step in the implementation guide. Keep the manifest unverified until evidence review finishes.
Run negative provider, model, region, fallback, contract, identity, network, privacy, audit, recovery, and supply-chain tests against the live boundary.
Complete the environment-specific data inventory and processor register. Add operating procedures for every store or processor that the built-in privacy worker cannot control.
Keep marketing claims disabled until the required independent report, certificate, validation, or authorization exists.

During the first operating period¶

Collect access, change, vulnerability, backup, restoration, incident, vendor, privacy, AI, audit-export, and evidence-access records for the required population and period.
Exercise incident response, breach decisions, business continuity, disaster recovery, privacy requests, payment segmentation, and human AI oversight.
Review profile and contract expiry, provider and model eligibility, exceptions, AI approvals, data retention, audit-chain reconciliation, alarms, and corrective actions on their defined cadence.
Complete internal audit and management review for the ISMS and AIMS. Resolve findings through the corrective-action process.

External assurance¶

Commission the selected SOC 2 examination and ISO/IEC 27001 and ISO/IEC 42001 certification work.
Complete HIPAA risk analysis and BAA operations plus GDPR/CCPA counsel review and required privacy assessments.
Complete the current CCM/CAIQ and selected CSA STAR submission or independent assurance route.
Let the acquirer or QSA confirm PCI scope and complete the applicable scans, tests, assessment, and attestation.
Follow the separate GovCloud readiness sequence before any FedRAMP deployment or claim.