Compliance
Keva's SOC 2 preparation work and current evidence boundaries
Keva is preparing for formal SOC 2 review. Keva is not currently claiming SOC 2 readiness, certification, or an auditor opinion. Selected controls and a bounded evidence inventory exist in local source; configured, deployed, and live-report proof remain unproven.
SOC 2 Type II Overview
What is SOC 2?
SOC 2 (Service Organization Control 2) is a security framework developed by the AICPA. It evaluates:
- Security - Protection against unauthorized access
- Availability - System operational availability
- Confidentiality - Protection of confidential information
- Processing Integrity - System processing is complete and accurate
- Privacy - Personal information handling
Type I vs Type II
| Type | Coverage | Duration |
|---|---|---|
| Type I | Controls designed | Point in time |
| Type II | Controls operating effectively | 6+ months |
Keva pursues Type II certification for ongoing operational evidence.
Current Compliance Status
Readiness: Unproven
No numerical readiness percentage is claimed. The configured platform evidence table is absent, so local source containment is not evidence of an operating compliance program.
Completed Phases
| Phase | Status | Description |
|---|---|---|
| Phase 1: Documentation | Local documents present | Policies require operational validation |
| Phase 2: Technical Controls | Partial local proof | Selected controls only; whole-application proof open |
| Phase 3: Evidence Collection | Local inventory only | Configured platform table and live reports unproven |
| Phase 4: Formal Audit | Planned | Third-party certification |
Trust Services Criteria Mapping
The entries below are preparation targets and source/policy references. They are not auditor-verified implementation or operating-effectiveness claims.
CC1: Control Environment
| Control | Implementation |
|---|---|
| Organizational structure | Defined roles and responsibilities |
| Security policies | 7 documented security policies |
| Risk assessment | Annual security reviews |
CC2: Communication & Information
| Control | Implementation |
|---|---|
| Security awareness | Onboarding and training |
| Incident communication | Slack alerts, email notifications |
| Change communication | Release notes, status page |
CC3: Risk Assessment
| Control | Implementation |
|---|---|
| Risk identification | Quarterly risk assessments |
| Vulnerability management | Weekly dependency updates |
| Penetration testing | Annual third-party tests |
CC5: Control Activities
| Control | Implementation |
|---|---|
| Access provisioning | RBAC with 38 permissions; operating proof remains open |
| Change management | Git-based with code review |
| Logical access | Clerk authentication with MFA |
CC6: Logical and Physical Access
| Control | Implementation |
|---|---|
| Authentication | MFA-enabled, session management |
| Authorization | Role-based access control |
| Encryption | Selected application credential envelopes use AES-256-GCM locally; whole-data and configured-storage proof remain open |
| Key management | Previous-key fallback exists; global re-encryption is suspended |
| Credential management | Selected encrypted envelopes and best-effort access evidence; universal coverage remains unproven |
CC7: System Operations
| Control | Implementation |
|---|---|
| Monitoring | Health-check source exists; configured scheduling and read-back remain unproven |
| Incident detection | Alert paths exist in source; configured delivery and read-back remain unproven |
| Audit logging | Selected event tracking; completeness remains unproven |
| Backup and recovery | Automated-backup and restore targets; provider configuration and recovery proof remain open |
CC8: Change Management
| Control | Implementation |
|---|---|
| Change approval | Git-based review target; repository- and deployment-enforcement proof remain open |
| Testing | Local and CI test definitions exist; configured branch enforcement remains unproven |
| Deployment | Build and deployment paths exist; zero-downtime behavior is unverified |
CC9: Risk Mitigation
| Control | Implementation |
|---|---|
| Business continuity | Multi-region target; configured infrastructure and recovery proof remain open |
| Vendor management | Third-party review policy target; completed-review evidence remains open |
| Insurance | Coverage target; current policy evidence is outside this source proof |
Evidence Collection
Current Evidence Boundary
Local source can assemble one bounded, read-only inventory from tenant-admin and tenant-free platform ledgers, disclose unavailable metrics, and audit-couple a fresh digest-bound export. The configured platform ledger is absent, quarterly access review is suspended, and archive scheduling, alert delivery, retention, deployment, and live report read-back remain unproven.
Evidence Types
| Evidence area | Current proof boundary |
|---|---|
| Audit logs | Local tenant inventory; configured platform ledger absent |
| Health checks | Exact local action taxonomy; configured scheduling/read-back unproven |
| Access reviews | Automation suspended; reviewer attestation absent |
| Incident reports | Source unavailable to the current evidence inventory |
Evidence Dashboard
The local super-admin source exposes Control Deck > SOC 2 Evidence as an evidence inventory without a readiness score. Configured navigation, report generation, and downloads remain unproven.
Security Policies
Documented Policies
Keva maintains these security policies:
- Information Security Policy - Overall security framework
- Access Control Policy - User provisioning and access
- Data Classification Policy - Data handling procedures
- Incident Response Policy - Security incident procedures
- Business Continuity Policy - Disaster recovery plans
- Vendor Management Policy - Third-party security
- Acceptable Use Policy - System usage guidelines
Policy Access
Request policy documents from your account manager or contact compliance@keva.support.
Quarterly Access Reviews
Review Process
Quarterly access-review automation is suspended. A future review process must inspect actual access grants, identify a reviewer, record attestation, and retain immutable evidence before this control can be claimed.
Review Actions
During access review:
- Remove inactive users
- Verify role assignments
- Update permissions as needed
- Document justifications
Security Questionnaires
Standard Responses
Keva provides pre-completed questionnaires:
- CAIQ (Consensus Assessment Initiative)
- SIG (Standardized Information Gathering)
- VSA (Vendor Security Alliance)
Custom Questionnaires
For custom security questionnaires:
- Contact your account manager
- Submit questionnaire
- Response within 5 business days
Certifications and Reports
Available Documents
| Document | Availability |
|---|---|
| SOC 2 Type II Report | Not currently available |
| Penetration Test Summary | Not currently proven available |
| Security Whitepaper | Public |
| Insurance Certificate | Upon request |
Requesting Documents
Contact compliance@keva.support with:
- Company name
- Document requested
- NDA status (if applicable)
Infrastructure Security
Cloud Security
- Configured provider: unverified by this local source/documentation proof
- Provider certifications: require current provider and report evidence
- Data residency: configured region and customer-data path remain unverified
- Encryption: Verify the exact application envelope, provider storage, backup, and transport boundary
Network Security
- DDoS protection is planned; active edge custody is unverified
- WAF (Web Application Firewall) configuration is unverified
- Eight selected route boundaries use fail-closed Redis throttling; configured Redis, universal edge coverage, and deployed enforcement are unverified
- SSRF protection
Application Security
- Regular security updates
- Dependency vulnerability scanning
- Secure coding practices
- Code review requirements
Contact
For compliance inquiries:
- Email: compliance@keva.support
- Security issues: security@keva.support