{"slug":"architecture/03_SECURITY_COMPLIANCE_PACK","title":"IntegrateWise Security & Compliance Pack","section":"architecture","sectionLabel":"Architecture","status":"unclassified","type":"document","path":"architecture/03_SECURITY_COMPLIANCE_PACK.mdx","bytes":44359,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n## Security Whitepaper & Compliance Documentation\n\n**Version:** 1.0  \n**Classification:** Public  \n**Last Updated:** January 2026  \n**Audience:** Procurement, IT Security, Compliance Teams\n\n---\n\n# Table of Contents\n\n1. [Executive Summary](#1-executive-summary)\n2. [Security Architecture](#2-security-architecture)\n3. [Data Security](#3-data-security)\n4. [Data Residency](#4-data-residency)\n5. [Encryption Policies](#5-encryption-policies)\n6. [Access Controls & Roles](#6-access-controls--roles)\n7. [Authentication & Identity](#7-authentication--identity)\n8. [Third-Party Vendors](#8-third-party-vendors)\n9. [Backup & Disaster Recovery](#9-backup--disaster-recovery)\n10. [Incident Response](#10-incident-response)\n11. [Audit Logging](#11-audit-logging)\n12. [Log Retention](#12-log-retention)\n13. [Compliance Status](#13-compliance-status)\n14. [Security Questionnaire](#14-security-questionnaire)\n\n---\n\n# 1. Executive Summary\n\n## 1.1 Security Commitment\n\nIntegrateWise is built with security as a foundational principle. We understand that our customers trust us with their most sensitive business data, and we take that responsibility seriously.\n\n**Core Security Principles:**\n\n| Principle                 | Implementation                                |\n| ------------------------- | --------------------------------------------- |\n| **Defense in Depth**      | Multiple layers of security controls          |\n| **Least Privilege**       | Minimum access required for function          |\n| **Zero Trust**            | Verify all requests, trust nothing by default |\n| **Encryption Everywhere** | Data encrypted at rest and in transit         |\n| **Transparency**          | Clear audit trails and logging                |\n| **User Control**          | You own your data, always                     |\n\n## 1.2 Security Highlights\n\n| Feature                   | Status                   |\n| ------------------------- | ------------------------ |\n| Data Encryption (Transit) | ✅ TLS 1.3               |\n| Data Encryption (Rest)    | ✅ AES-256               |\n| Multi-Tenant Isolation    | ✅ Row-Level Security    |\n| MFA Support               | ✅ TOTP-based            |\n| SSO/SAML                  | ✅ Enterprise plan       |\n| SOC 2 Type II             | 🔄 In progress (Q2 2026) |\n| GDPR Compliant            | ✅                       |\n| Data Export               | ✅ On-demand             |\n| Data Deletion             | ✅ Within 30 days        |\n\n## 1.3 You Own Your Data\n\nIntegrateWise operates on a fundamental principle: **your data belongs to you**.\n\n- **No data selling:** We never sell, rent, or share your data\n- **No AI training:** Your data is never used to train AI models\n- **Full portability:** Export all your data anytime\n- **Complete deletion:** Request deletion and we remove everything\n- **Transparent processing:** We only process data as you direct\n\n---\n\n# 2. Security Architecture\n\n## 2.1 Infrastructure Security\n\n```\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                         SECURITY ARCHITECTURE                                │\n└─────────────────────────────────────────────────────────────────────────────┘\n\n                              INTERNET\n                                 │\n                    ┌────────────┴────────────┐\n                    │                         │\n                    ▼                         ▼\n         ┌─────────────────┐       ┌─────────────────┐\n         │  DDoS Mitigation│       │  Bot Detection  │\n         │  (Cloudflare)   │       │  (Cloudflare)   │\n         └────────┬────────┘       └────────┬────────┘\n                  │                         │\n                  └───────────┬─────────────┘\n                              │\n                              ▼\n                   ┌─────────────────────┐\n                   │   Web Application   │\n                   │   Firewall (WAF)    │\n                   │   • OWASP Top 10    │\n                   │   • Rate Limiting   │\n                   │   • IP Reputation   │\n                   └──────────┬──────────┘\n                              │\n                              ▼\n                   ┌─────────────────────┐\n                   │   TLS Termination   │\n                   │   • TLS 1.3 only    │\n                   │   • HSTS enabled    │\n                   │   • Certificate pin │\n                   └──────────┬──────────┘\n                              │\n                              ▼\n                   ┌─────────────────────┐\n                   │  API Authentication │\n                   │   • JWT validation  │\n                   │   • API key verify  │\n                   │   • Session check   │\n                   └──────────┬──────────┘\n                              │\n                              ▼\n                   ┌─────────────────────┐\n                   │   Authorization     │\n                   │   • RBAC check      │\n                   │   • Scope verify    │\n                   │   • Tenant isolate  │\n                   └──────────┬──────────┘\n                              │\n                              ▼\n                   ┌─────────────────────┐\n                   │   Data Layer       │\n                   │   • RLS policies    │\n                   │   • Encrypted data  │\n                   │   • Audit logging   │\n                   └─────────────────────┘\n```\n\n## 2.2 Network Security\n\n| Control             | Implementation                    |\n| ------------------- | --------------------------------- |\n| **DDoS Protection** | Cloudflare (automatic, always-on) |\n| **WAF**             | Cloudflare WAF with custom rules  |\n| **Rate Limiting**   | Per-endpoint, per-tenant limits   |\n| **IP Allowlisting** | Optional for enterprise customers |\n| **TLS Version**     | TLS 1.3 required (1.2 minimum)    |\n| **Certificate**     | Managed, auto-renewed             |\n\n## 2.3 Application Security\n\n| Control                 | Implementation                      |\n| ----------------------- | ----------------------------------- |\n| **Input Validation**    | Zod schema validation on all inputs |\n| **Output Encoding**     | Context-aware encoding              |\n| **SQL Injection**       | Parameterized queries (Prisma ORM)  |\n| **XSS Prevention**      | React auto-escaping + CSP headers   |\n| **CSRF Protection**     | SameSite cookies + tokens           |\n| **Dependency Scanning** | Automated (Dependabot, Snyk)        |\n| **Code Review**         | Required for all changes            |\n\n---\n\n# 3. Data Security\n\n## 3.1 Data Classification\n\n| Classification   | Description        | Examples               | Controls                     |\n| ---------------- | ------------------ | ---------------------- | ---------------------------- |\n| **Public**       | Non-sensitive      | Marketing materials    | Basic                        |\n| **Internal**     | Business data      | Account names, emails  | Encrypted, access-controlled |\n| **Confidential** | Sensitive business | Revenue, health scores | Encrypted, audit logged      |\n| **Restricted**   | Highly sensitive   | API keys, tokens       | Encrypted, minimal access    |\n\n## 3.2 Data Flow Security\n\n```\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                         DATA FLOW SECURITY                                   │\n└─────────────────────────────────────────────────────────────────────────────┘\n\n     External Tool                IntegrateWise                    User\n     (e.g., HubSpot)\n           │                            │                            │\n           │  TLS 1.3 encrypted         │                            │\n           ├───────────────────────────▶│                            │\n           │                            │                            │\n           │                     ┌──────┴──────┐                     │\n           │                     │ API Gateway │                     │\n           │                     │ (Edge)      │                     │\n           │                     └──────┬──────┘                     │\n           │                            │                            │\n           │                     ┌──────┴──────┐                     │\n           │                     │ Transform   │                     │\n           │                     │ & Validate  │                     │\n           │                     └──────┬──────┘                     │\n           │                            │                            │\n           │                     ┌──────┴──────┐                     │\n           │                     │ Encrypt at  │                     │\n           │                     │ Rest (AES)  │                     │\n           │                     └──────┬──────┘                     │\n           │                            │                            │\n           │                     ┌──────┴──────┐                     │\n           │                     │ PostgreSQL  │                     │\n           │                     │ (Supabase)  │                     │\n           │                     └──────┬──────┘                     │\n           │                            │                            │\n           │                            │  TLS 1.3 encrypted         │\n           │                            ├───────────────────────────▶│\n           │                            │                            │\n```\n\n## 3.3 Data Isolation\n\n**Multi-Tenant Architecture:**\n\nEvery customer's data is logically isolated using PostgreSQL Row-Level Security (RLS):\n\n```sql\n-- All tables include organization_id\n-- RLS policies enforce tenant isolation\n\nALTER TABLE accounts ENABLE ROW LEVEL SECURITY;\n\nCREATE POLICY tenant_isolation ON accounts\n  FOR ALL\n  USING (organization_id = current_setting('app.organization_id')::UUID);\n\n-- Customer A can NEVER access Customer B's data\n-- Even if SQL injection occurred, RLS prevents cross-tenant access\n```\n\n| Isolation Method | Implementation                  |\n| ---------------- | ------------------------------- |\n| **Database**     | Row-Level Security (RLS)        |\n| **Application**  | Tenant context in every request |\n| **Storage**      | Prefixed by organization ID     |\n| **Cache**        | Tenant-scoped keys              |\n| **Logs**         | Filtered by organization        |\n\n---\n\n# 4. Data Residency\n\n## 4.1 Primary Data Locations\n\n| Data Type            | Location   | Provider | Region                  |\n| -------------------- | ---------- | -------- | ----------------------- |\n| **Primary Database** | AWS        | Supabase | us-east-1 (N. Virginia) |\n| **Database Backups** | AWS        | Supabase | us-east-1               |\n| **File Storage**     | Cloudflare | R2       | Global (edge-cached)    |\n| **Edge Cache**       | Cloudflare | KV       | Global (300+ PoPs)      |\n| **Application**      | Cloudflare | Workers  | Global (edge)           |\n\n## 4.2 Data Residency Statement\n\n**Current Status:**\n\n- Primary data storage is in **United States (AWS us-east-1)**\n- Edge caching occurs globally but is temporary (< 60 minutes)\n- Backups remain in the same region as primary data\n\n**EU Data Residency (Roadmap Q4 2026):**\n\n- Dedicated EU region option (AWS eu-west-1)\n- EU-only data processing\n- Data sovereignty compliance\n\n## 4.3 Cross-Border Data Transfers\n\nFor customers outside the United States:\n\n| Mechanism                               | Status                           |\n| --------------------------------------- | -------------------------------- |\n| **Standard Contractual Clauses (SCCs)** | Available on request             |\n| **Data Processing Agreement (DPA)**     | Included in Enterprise contracts |\n| **EU-US Data Privacy Framework**        | Pending (vendors in progress)    |\n\n---\n\n# 5. Encryption Policies\n\n## 5.1 Encryption Overview\n\n| State                  | Method      | Key Size | Details                    |\n| ---------------------- | ----------- | -------- | -------------------------- |\n| **In Transit**         | TLS 1.3     | 256-bit  | All connections            |\n| **At Rest (Database)** | AES-256     | 256-bit  | Supabase managed           |\n| **At Rest (Files)**    | AES-256     | 256-bit  | Cloudflare R2              |\n| **At Rest (Backups)**  | AES-256     | 256-bit  | Encrypted snapshots        |\n| **Secrets**            | AES-256-GCM | 256-bit  | Cloudflare Workers secrets |\n\n## 5.2 Encryption in Transit\n\n```\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                     ENCRYPTION IN TRANSIT                                    │\n└─────────────────────────────────────────────────────────────────────────────┘\n\n     User Browser                API Gateway                    Database\n           │                         │                              │\n           │      TLS 1.3            │                              │\n           │  ────────────────────▶  │                              │\n           │  • ECDHE key exchange   │                              │\n           │  • AES-256-GCM cipher   │                              │\n           │  • Perfect Forward Sec  │                              │\n           │                         │                              │\n           │                         │       TLS 1.3                │\n           │                         │  ─────────────────────────▶  │\n           │                         │  • Mutual TLS (mTLS)         │\n           │                         │  • Certificate pinning       │\n           │                         │                              │\n```\n\n**TLS Configuration:**\n\n- Minimum version: TLS 1.2 (TLS 1.3 preferred)\n- Cipher suites: Modern, AEAD-only\n- HSTS: Enabled (max-age=31536000)\n- Certificate: 2048-bit RSA, auto-renewed\n\n## 5.3 Encryption at Rest\n\n**Database Encryption:**\n\n```\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                      DATABASE ENCRYPTION                                     │\n└─────────────────────────────────────────────────────────────────────────────┘\n\n     Application                    Supabase                      AWS KMS\n          │                            │                              │\n          │  Plaintext data            │                              │\n          │  ─────────────────────▶    │                              │\n          │                            │                              │\n          │                            │   Request DEK                │\n          │                            │  ─────────────────────────▶  │\n          │                            │                              │\n          │                            │   DEK (encrypted with CMK)   │\n          │                            │  ◀─────────────────────────  │\n          │                            │                              │\n          │                     ┌──────┴──────┐                       │\n          │                     │  Encrypt    │                       │\n          │                     │  with DEK   │                       │\n          │                     │  (AES-256)  │                       │\n          │                     └──────┬──────┘                       │\n          │                            │                              │\n          │                     ┌──────┴──────┐                       │\n          │                     │  Store      │                       │\n          │                     │  encrypted  │                       │\n          │                     │  on disk    │                       │\n          │                     └─────────────┘                       │\n```\n\n**Key Management:**\n\n- Customer Master Keys (CMK): AWS KMS managed\n- Data Encryption Keys (DEK): Rotated automatically\n- Key access: Logged and audited\n- No customer access to encryption keys (managed service)\n\n## 5.4 Sensitive Field Encryption\n\nAdditional encryption for highly sensitive fields:\n\n| Field               | Encryption      | Notes                             |\n| ------------------- | --------------- | --------------------------------- |\n| **OAuth Tokens**    | AES-256-GCM     | Application-level encryption      |\n| **API Keys**        | Hashed (bcrypt) | One-way hash, cannot be decrypted |\n| **Webhook Secrets** | AES-256-GCM     | Application-level encryption      |\n\n---\n\n# 6. Access Controls & Roles\n\n## 6.1 Role-Based Access Control (RBAC)\n\nIntegrateWise implements RBAC with four standard roles:\n\n| Role        | Description      | Permissions                               |\n| ----------- | ---------------- | ----------------------------------------- |\n| **Admin**   | Full access      | All permissions including user management |\n| **Manager** | Team lead access | Read/write + cross-team visibility        |\n| **Member**  | Standard user    | Read/write within assigned team           |\n| **Viewer**  | Read-only        | View dashboards and reports only          |\n\n## 6.2 Permission Matrix\n\n| Permission         | Admin | Manager | Member | Viewer |\n| ------------------ | :---: | :-----: | :----: | :----: |\n| View accounts      |  ✅   |   ✅    |   ✅   |   ✅   |\n| Edit accounts      |  ✅   |   ✅    |   ✅   |   ❌   |\n| Delete accounts    |  ✅   |   ✅    |   ❌   |   ❌   |\n| View all teams     |  ✅   |   ✅    |   ❌   |   ❌   |\n| Manage users       |  ✅   |   ❌    |   ❌   |   ❌   |\n| API key management |  ✅   |   ❌    |   ❌   |   ❌   |\n| Integration setup  |  ✅   |   ✅    |   ❌   |   ❌   |\n| Automation create  |  ✅   |   ✅    |   ✅   |   ❌   |\n| Automation approve |  ✅   |   ✅    |   ❌   |   ❌   |\n| View audit logs    |  ✅   |   ✅    |   ❌   |   ❌   |\n| Export data        |  ✅   |   ✅    |   ❌   |   ❌   |\n\n## 6.3 Hub-Based Access Control\n\nIn addition to roles, access is controlled by Hub (team/function) membership:\n\n```\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                      HUB-BASED ACCESS CONTROL                                │\n└─────────────────────────────────────────────────────────────────────────────┘\n\n     User: jane@company.com\n     Role: Member\n     Hubs: [Sales, Customer Success]\n\n     ┌─────────────┐     ┌─────────────┐     ┌─────────────┐\n     │   Sales     │     │     CS      │     │   Finance   │\n     │    Hub      │     │    Hub      │     │    Hub      │\n     ├─────────────┤     ├─────────────┤     ├─────────────┤\n     │ • Deals     │     │ • Health    │     │ • Invoices  │\n     │ • Pipeline  │     │ • Renewals  │     │ • Revenue   │\n     │ • Leads     │     │ • Tickets   │     │ • Billing   │\n     └─────────────┘     └─────────────┘     └─────────────┘\n           │                   │                   │\n           ▼                   ▼                   ▼\n         ✅ Access          ✅ Access          ❌ No Access\n```\n\n## 6.4 SOC 2 Control Mapping\n\n| SOC 2 Control                     | IntegrateWise Implementation         |\n| --------------------------------- | ------------------------------------ |\n| **CC6.1** - Logical access        | RBAC + Hub-based access              |\n| **CC6.2** - Prior authorization   | Role assignment requires Admin       |\n| **CC6.3** - Access removal        | Immediate on user deactivation       |\n| **CC6.6** - Access review         | Quarterly access review (Admin tool) |\n| **CC6.7** - User responsibilities | Security policy acceptance           |\n\n---\n\n# 7. Authentication & Identity\n\n## 7.1 Authentication Methods\n\n| Method               | Availability | Details                                    |\n| -------------------- | ------------ | ------------------------------------------ |\n| **Email + Password** | All plans    | Minimum 12 characters, complexity required |\n| **Magic Link**       | All plans    | Passwordless email authentication          |\n| **Google SSO**       | All plans    | OAuth 2.0                                  |\n| **Microsoft SSO**    | Pro+ plans   | OAuth 2.0 / Azure AD                       |\n| **SAML 2.0**         | Enterprise   | Custom IdP integration                     |\n| **MFA (TOTP)**       | All plans    | Google Authenticator, Authy, etc.          |\n\n## 7.2 Password Policy\n\n| Requirement    | Value                              |\n| -------------- | ---------------------------------- |\n| Minimum length | 12 characters                      |\n| Complexity     | Upper, lower, number, symbol       |\n| History        | Last 5 passwords blocked           |\n| Expiration     | Optional (90 days recommended)     |\n| Lockout        | 5 failed attempts → 15 min lockout |\n\n## 7.3 Session Management\n\n| Setting               | Value                               |\n| --------------------- | ----------------------------------- |\n| Session timeout (web) | 24 hours                            |\n| Session timeout (API) | No expiration (API key)             |\n| Concurrent sessions   | Unlimited (configurable)            |\n| Session invalidation  | Immediate on logout/password change |\n| Refresh token         | 7 days                              |\n\n## 7.4 MFA Implementation\n\n```\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                      MFA AUTHENTICATION FLOW                                 │\n└─────────────────────────────────────────────────────────────────────────────┘\n\n     User                        IntegrateWise                    TOTP App\n       │                              │                              │\n       │  1. Email + Password         │                              │\n       │  ───────────────────────▶    │                              │\n       │                              │                              │\n       │  2. \"Enter MFA code\"         │                              │\n       │  ◀───────────────────────    │                              │\n       │                              │                              │\n       │                              │                              │\n       │  3. Get code                 │                              │\n       │  ──────────────────────────────────────────────────────▶    │\n       │                              │                              │\n       │  4. 6-digit code             │                              │\n       │  ◀──────────────────────────────────────────────────────    │\n       │                              │                              │\n       │  5. Submit code              │                              │\n       │  ───────────────────────▶    │                              │\n       │                              │                              │\n       │                       ┌──────┴──────┐                       │\n       │                       │ Verify TOTP │                       │\n       │                       │ (30s window)│                       │\n       │                       └──────┬──────┘                       │\n       │                              │                              │\n       │  6. Access granted           │                              │\n       │  ◀───────────────────────    │                              │\n```\n\n## 7.5 Enterprise SSO (SAML)\n\nFor Enterprise customers:\n\n| Feature                | Support                                        |\n| ---------------------- | ---------------------------------------------- |\n| **IdP Support**        | Okta, Azure AD, OneLogin, PingFederate, custom |\n| **Just-In-Time (JIT)** | User auto-provisioning on first login          |\n| **Group Mapping**      | IdP groups → IntegrateWise roles               |\n| **Forced SSO**         | Disable password auth for org                  |\n| **SCIM**               | Coming Q3 2026                                 |\n\n---\n\n# 8. Third-Party Vendors\n\n## 8.1 Sub-Processors List\n\n| Vendor         | Purpose                       | Data Processed              | Location  | Certifications            |\n| -------------- | ----------------------------- | --------------------------- | --------- | ------------------------- |\n| **Cloudflare** | CDN, Edge compute, WAF        | All traffic, cached content | Global    | SOC 2, ISO 27001          |\n| **Supabase**   | Database, Auth                | All customer data           | US (AWS)  | SOC 2                     |\n| **AWS**        | Infrastructure (via Supabase) | Database storage            | us-east-1 | SOC 2, ISO 27001, FedRAMP |\n| **OpenAI**     | AI completions                | Prompts, responses          | US        | SOC 2                     |\n| **Anthropic**  | AI completions                | Prompts, responses          | US        | SOC 2                     |\n| **n8n Cloud**  | Workflow automation           | Workflow data               | EU/US     | SOC 2 in progress         |\n\n## 8.2 Vendor Security Requirements\n\nAll vendors must meet:\n\n- [ ] SOC 2 Type II certification (or equivalent)\n- [ ] Encryption at rest and in transit\n- [ ] Access controls and audit logging\n- [ ] Incident notification within 72 hours\n- [ ] Annual security review\n\n## 8.3 AI Data Processing\n\n**OpenAI / Anthropic:**\n\n| Concern               | Policy                             |\n| --------------------- | ---------------------------------- |\n| **Data retention**    | Not retained after response        |\n| **Model training**    | Your data is NOT used for training |\n| **API security**      | TLS encryption, API key auth       |\n| **Data minimization** | Only necessary context sent        |\n\nWe use the **API** versions of these services, not the consumer products. API terms explicitly prohibit using customer data for model training.\n\n---\n\n# 9. Backup & Disaster Recovery\n\n## 9.1 Backup Strategy\n\n| Backup Type          | Frequency  | Retention | Location     |\n| -------------------- | ---------- | --------- | ------------ |\n| **Full database**    | Daily      | 30 days   | Same region  |\n| **Point-in-time**    | Continuous | 7 days    | Same region  |\n| **Transaction logs** | Continuous | 7 days    | Same region  |\n| **File storage**     | Replicated | 30 days   | Multi-region |\n\n## 9.2 Recovery Objectives\n\n| Metric                             | Target  | Tested    |\n| ---------------------------------- | ------- | --------- |\n| **RTO** (Recovery Time Objective)  | 4 hours | Quarterly |\n| **RPO** (Recovery Point Objective) | 1 hour  | Quarterly |\n| **Backup verification**            | Weekly  | Automated |\n\n## 9.3 Disaster Recovery Plan\n\n```\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                      DISASTER RECOVERY TIERS                                 │\n└─────────────────────────────────────────────────────────────────────────────┘\n\n     Tier 1: Application failure (single component)\n     ──────────────────────────────────────────────\n     Response: Automatic failover (< 1 minute)\n     • Cloudflare Workers: Auto-restart\n     • Supabase: Connection retry\n     • n8n: Job retry queue\n\n     Tier 2: Database failure\n     ────────────────────────\n     Response: Failover to replica (< 15 minutes)\n     • Automatic failover to hot standby\n     • DNS update propagation\n     • Application reconnection\n\n     Tier 3: Region failure (AWS us-east-1)\n     ──────────────────────────────────────\n     Response: Manual failover (< 4 hours)\n     • Restore from backup to alternate region\n     • Update DNS records\n     • Notify customers\n\n     Tier 4: Complete infrastructure failure\n     ───────────────────────────────────────\n     Response: Rebuild from backups (< 24 hours)\n     • Restore database from off-site backup\n     • Redeploy application from source control\n     • Regenerate secrets (customer action required)\n```\n\n## 9.4 Data Recovery for Customers\n\n| Request Type                         | SLA         | Process         |\n| ------------------------------------ | ----------- | --------------- |\n| **Accidental deletion (< 24 hours)** | 4 hours     | Support request |\n| **Historical data recovery**         | 24-48 hours | Support request |\n| **Point-in-time recovery**           | 24 hours    | Enterprise only |\n\n---\n\n# 10. Incident Response\n\n## 10.1 Incident Classification\n\n| Severity          | Definition                       | Response Time     | Notification    |\n| ----------------- | -------------------------------- | ----------------- | --------------- |\n| **Critical (P1)** | Service unavailable, data breach | 15 minutes        | Immediate       |\n| **High (P2)**     | Major feature unavailable        | 1 hour            | Within 4 hours  |\n| **Medium (P3)**   | Minor feature issue              | 4 hours           | Within 24 hours |\n| **Low (P4)**      | Cosmetic, minor bugs             | Next business day | None            |\n\n## 10.2 Incident Response Process\n\n```\n┌─────────────────────────────────────────────────────────────────────────────┐\n│                      INCIDENT RESPONSE FLOW                                  │\n└─────────────────────────────────────────────────────────────────────────────┘\n\n     1. DETECTION                    2. TRIAGE                    3. CONTAINMENT\n     ─────────────                   ─────────                    ─────────────\n     • Monitoring alerts             • Assess severity            • Isolate affected\n     • Customer report               • Assign incident lead       • Stop bleeding\n     • Security scanner              • Open incident channel      • Preserve evidence\n\n           │                              │                              │\n           ▼                              ▼                              ▼\n\n     4. INVESTIGATION                5. REMEDIATION               6. RECOVERY\n     ────────────────                ─────────────                ──────────\n     • Root cause analysis           • Deploy fix                 • Restore service\n     • Timeline reconstruction       • Patch vulnerability        • Verify integrity\n     • Scope determination           • Update defenses            • Monitor closely\n\n           │                              │                              │\n           └──────────────────────────────┴──────────────────────────────┘\n                                          │\n                                          ▼\n\n     7. POST-INCIDENT\n     ─────────────────\n     • Incident report (within 72 hours)\n     • Lessons learned\n     • Process improvements\n     • Customer communication (if applicable)\n```\n\n## 10.3 Security Incident Communication\n\n**Customer Notification Timeline:**\n\n| Event                                  | Notification                     |\n| -------------------------------------- | -------------------------------- |\n| **Security incident detected**         | Status page update within 1 hour |\n| **Customer data potentially affected** | Direct email within 24 hours     |\n| **Incident contained**                 | Status page update               |\n| **Root cause determined**              | Detailed report within 72 hours  |\n| **Remediation complete**               | Final report within 7 days       |\n\n## 10.4 Contact for Security Issues\n\n**Security Team Contact:**\n\n- Email: security@integratewise.com\n- Response SLA: 24 hours for non-critical, 4 hours for critical\n\n**Vulnerability Disclosure:**\n\n- Email: security@integratewise.com\n- Subject: \"Responsible Disclosure: [Brief Description]\"\n- We do not currently have a bug bounty program\n\n---\n\n# 11. Audit Logging\n\n## 11.1 What We Log\n\n| Event Category     | Events Logged                       | Retention |\n| ------------------ | ----------------------------------- | --------- |\n| **Authentication** | Login, logout, MFA, password change | 2 years   |\n| **Authorization**  | Permission changes, role changes    | 2 years   |\n| **Data Access**    | Read, create, update, delete        | 1 year    |\n| **Administrative** | User management, settings changes   | 2 years   |\n| **Integration**    | Connection, sync, disconnect        | 1 year    |\n| **Security**       | Failed logins, blocked requests     | 2 years   |\n\n## 11.2 Audit Log Format\n\n```json\n{\n  \"id\": \"log_a1b2c3d4e5f6\",\n  \"timestamp\": \"2026-01-07T10:30:00.000Z\",\n  \"organization_id\": \"org_xyz789\",\n  \"user_id\": \"usr_abc123\",\n  \"user_email\": \"jane@company.com\",\n  \"action\": \"account.update\",\n  \"resource_type\": \"account\",\n  \"resource_id\": \"acc_def456\",\n  \"changes\": {\n    \"health_score\": {\n      \"from\": 72,\n      \"to\": 45\n    }\n  },\n  \"ip_address\": \"192.168.1.1\",\n  \"user_agent\": \"Mozilla/5.0...\",\n  \"request_id\": \"req_ghi789\"\n}\n```\n\n## 11.3 Accessing Audit Logs\n\n**In Application:**\n\n- Settings → Audit Logs (Admin role required)\n- Filter by user, action, date range\n- Export to CSV\n\n**Via API:**\n\n```bash\nGET /v1/audit-logs?start_date=2026-01-01&end_date=2026-01-07&action=account.*\n```\n\n---\n\n# 12. Log Retention\n\n## 12.1 Retention Policies\n\n| Log Type             | Retention | Storage          | Deletion  |\n| -------------------- | --------- | ---------------- | --------- |\n| **Audit logs**       | 2 years   | PostgreSQL       | Automatic |\n| **Application logs** | 30 days   | Cloudflare       | Automatic |\n| **Security logs**    | 2 years   | PostgreSQL       | Automatic |\n| **Access logs**      | 90 days   | Cloudflare       | Automatic |\n| **Error logs**       | 90 days   | External service | Automatic |\n\n## 12.2 Customer Data Retention\n\n| Data Type             | Active Account  | After Account Closure |\n| --------------------- | --------------- | --------------------- |\n| **Business data**     | Retained        | 30 days then deleted  |\n| **Audit logs**        | 2 years         | 30 days then deleted  |\n| **Backups**           | 30 days rolling | Purged within 30 days |\n| **Files/attachments** | Retained        | 30 days then deleted  |\n\n## 12.3 Data Deletion Process\n\nUpon account closure or deletion request:\n\n1. **Immediate:** Disable access, mark for deletion\n2. **Within 7 days:** Remove from active database\n3. **Within 30 days:** Purge from backups\n4. **Confirmation:** Email confirmation of deletion\n\n---\n\n# 13. Compliance Status\n\n## 13.1 Current Certifications\n\n| Framework         | Status       | Timeline |\n| ----------------- | ------------ | -------- |\n| **SOC 2 Type I**  | In progress  | Q1 2026  |\n| **SOC 2 Type II** | Planned      | Q2 2026  |\n| **ISO 27001**     | Roadmap      | 2027     |\n| **HIPAA**         | Roadmap      | 2027     |\n| **GDPR**          | ✅ Compliant | -        |\n| **CCPA**          | ✅ Compliant | -        |\n\n## 13.2 GDPR Compliance\n\n| GDPR Right                 | Implementation                          |\n| -------------------------- | --------------------------------------- |\n| **Right to Access**        | Data export feature (Settings → Export) |\n| **Right to Rectification** | Edit any record in app                  |\n| **Right to Erasure**       | Account deletion (30-day process)       |\n| **Right to Portability**   | Export in standard formats (JSON, CSV)  |\n| **Right to Object**        | Contact support to object to processing |\n| **Data Minimization**      | Only collect necessary data             |\n\n**Data Processing Agreement (DPA):** Available upon request for customers who require it.\n\n## 13.3 SOC 2 Trust Service Criteria\n\n| Criteria                 | Controls in Place                     |\n| ------------------------ | ------------------------------------- |\n| **Security**             | WAF, encryption, access controls, MFA |\n| **Availability**         | 99.9% SLA, DR plan, monitoring        |\n| **Processing Integrity** | Input validation, audit logs, testing |\n| **Confidentiality**      | Encryption, access controls, NDA      |\n| **Privacy**              | GDPR compliance, data minimization    |\n\n---\n\n# 14. Security Questionnaire\n\n## 14.1 Common Questions\n\n### Infrastructure\n\n**Q: Where is data stored?**\nA: Primary data is stored in AWS us-east-1 (N. Virginia) via Supabase. Edge caching uses Cloudflare's global network.\n\n**Q: Is data encrypted?**\nA: Yes. TLS 1.3 in transit, AES-256 at rest.\n\n**Q: Do you have a SOC 2 report?**\nA: SOC 2 Type II is in progress (expected Q2 2026). Contact security@integratewise.com for current status.\n\n### Access Control\n\n**Q: How is access controlled?**\nA: Role-based access control (RBAC) with four roles. Additional Hub-based access for team isolation.\n\n**Q: Do you support SSO?**\nA: Yes. Google and Microsoft OAuth for all plans. SAML 2.0 for Enterprise.\n\n**Q: Is MFA supported?**\nA: Yes. TOTP-based MFA available for all users.\n\n### Data Handling\n\n**Q: Can I export my data?**\nA: Yes. Full export available in JSON and CSV formats from Settings → Export.\n\n**Q: What happens when I close my account?**\nA: All data is deleted within 30 days, including backups.\n\n**Q: Is my data used for AI training?**\nA: No. Your data is never used for AI model training. We use API versions of OpenAI/Anthropic which prohibit training on customer data.\n\n### Incident Response\n\n**Q: How do I report a security issue?**\nA: Email security@integratewise.com. We respond within 24 hours.\n\n**Q: Will I be notified of a breach?**\nA: Yes. Within 24 hours if your data is potentially affected.\n\n### Vendor Management\n\n**Q: Who are your sub-processors?**\nA: Cloudflare, Supabase (AWS), OpenAI, Anthropic, n8n Cloud. Full list in Section 8.\n\n**Q: Are vendors SOC 2 certified?**\nA: Yes. All primary vendors have SOC 2 Type II or equivalent.\n\n---\n\n# Appendix A: Security Contacts\n\n| Purpose                   | Contact                      |\n| ------------------------- | ---------------------------- |\n| **Security questions**    | security@integratewise.com   |\n| **Vulnerability reports** | security@integratewise.com   |\n| **DPA requests**          | legal@integratewise.com      |\n| **Compliance inquiries**  | compliance@integratewise.com |\n| **General support**       | support@integratewise.com    |\n\n---\n\n# Appendix B: Document History\n\n| Version | Date         | Changes         |\n| ------- | ------------ | --------------- |\n| 1.0     | January 2026 | Initial release |\n\n---\n\n**IntegrateWise Security & Compliance Pack**  \n_Version 1.0 — January 2026_\n\nFor security questions: security@integratewise.com\n"}