Owner: the founder. Approved: 2026-10-08. Review: annually, and on any significant change — an auditor engaged, a report issued, a customer audit.
| Kind | Status |
|---|---|
| CSA STAR Level 1 — self-assessment against the CSA Cloud Controls Matrix, answered in the CAIQ v4.1 | First self-assessment in preparation (October 2026), for publication on the CSA STAR Registry under GlobalDeal Inc. (d/b/a Ataski) once submitted and accepted. Self-assessed; no third party checks it |
/trust |
Each control is resolved from the code and configuration at build time and printed with its basis (code, provider terms, or written document). A control the code cannot back is shown amber and not counted |
| Automated checks | The pre-push gate (scripts/check.py, ADR-0119) runs the security and isolation tests on every push — on the founder's machine, with no independent witness |
| SOC 2 | None. No Type 1 or Type 2 report, and no auditor engaged. Public wording about SOC 2 follows acceptable-use.md §6 — never "compliant", "certified" or a badge |
| ISO/IEC 27001 | None |
| Penetration test | None performed; none booked. /trust says so |
| Activity | When | Status at approval |
|---|---|---|
| CAIQ self-assessment | annually, and after a significant change: a new hosting provider, a new kind of sub-processor, an ADR touching an architectural principle, or a SEV-1 incident | first one in preparation |
Quarterly self-review (docs/security/evidence-checklist.md) — access review, change log, scans, incidents, the risk register |
first working day of each quarter | no signed review on record yet; the first access review is not signed off |
Evidence folder (scripts/collect_soc2_evidence.py) |
run by hand before a review or an audit | a script, not a schedule; no run is recorded |
Vendor review (vendor-management.md §5) |
annually | never performed |
Restore drill (business-continuity.md §5) |
monthly job, annual write-up | never run — the job reports "not configured" |
Incident-response tabletop (incident-response.md §7) |
annually | never run |
Policy re-read and acknowledgement (README.md) |
annually | acknowledgements pending |
The status column is the point: a cadence that has not yet produced a record is written as such, and the self-assessment answers follow the record, not the cadence.
A finding is anything that makes a statement untrue or a control weaker than written: a "No" in the self-assessment, a gap found at the quarterly review, a question from a customer we cannot answer "yes" to, an incident's corrective action, and — when there is one — a penetration-test result.
docs/security/risk-register.md when it is a
risk, or in the gap list of docs/security/soc2-readiness.md when it is a
control gap. A vulnerability takes its deadline from
vulnerability-management.md./trust, a policy or a
self-assessment answer untrue, that text is corrected before the fix is
started, not after it ships.This tracking starts with the findings of the October 2026 self-assessment.
Under the served DPA (§6, audit) a customer may ask for the information needed to
show compliance, and may audit at most once per calendar year unless a
supervisory authority requires more. We answer first with /trust, the policies
at /trust/policies, the self-assessment, and the transfer impact assessment on
request. Requests go to security@ataski.com.
There is none: every assessment above is made by the person who operates the system. That is disclosed rather than presented as assurance. The first independent assurance — a penetration test, then a SOC 2 Type 1 report — is planned for when it can be funded; neither is committed today.