Compliance Posture & Controls
- Scope
- Which security and governance controls the software implements, and which are left to whoever operates it
- Basis
- Code in this repository and internal security reviews (July–September 2026, not published)
- Related
- Security Architecture, Secrets, Threat Model, Governance & Guardrails
Certification statement
The open-source VegaDūta software carries no certification: it is not SOC 2, ISO/IEC 42001, ISO 27001, HIPAA or any other attested product, and this page makes no GDPR, DPDP or other compliance claim. Compliance is a property of a deployment and its operator. The controls below are mechanisms you can build a program on; an auditor has not tested them.
1. Framework mapping
| Framework | How the code relates |
|---|---|
| SOC 2 (Security, Availability, Confidentiality) | Most CC6/CC7/CC8 technical controls below have a code artifact. Privacy and Processing Integrity criteria are not addressed specifically. |
| ISO/IEC 42001 (AI management system) | Human-oversight, guardrail, audit and kill-switch mechanisms exist; the management-system parts (risk register, roles, reviews) are organisational and out of scope for the code. |
| India DPDP | The software supports DPDP-oriented controls: an optional notice and consent step with a consent record, purpose tags, retention periods with a nightly purge, per-contact export and erasure, and an audit-event export with a breach runbook (section 2). They are engineering controls with documented limits, not a statement that any deployment complies; lawful basis, notice wording, processor agreements, children's data and the legal reading are the operator's and counsel's. See DPDP obligations and controls. |
| GDPR | Code has a data-subject erasure path and an informational residency field (below); lawful basis, notices, DPAs and processor agreements are the operator's responsibility. |
Convention: implemented means an artifact exists in code or config; policy / gap means the operator must supply it.
2. Implemented controls
"Implemented" means the mechanism exists in the repository, not that an auditor has tested it or that a given deployment runs it.
| Control | Where implemented | Evidence |
|---|---|---|
| SSO-capable authentication, dual issuer, authorized-party allowlist | Keycloak OIDC; SecurityConfig decoder | core/security/.../SecurityConfig.java; ADR-0005 |
| Route-level authorization with granular permissions | PERM_* authority matchers | SecurityConfig.java |
| Denied-access auditing | AuditingAccessDeniedHandler to authz.denied audit entries | core/security/.../AuditingAccessDeniedHandler.java, core/admin/.../AuditLogAccessDeniedListener.java |
| Tenant data isolation | Schema-per-tenant; claim-less token rejection; sanitized schema names | core/tenancy, TenantContextFilter.java; ADR-0002 |
| Credentials encrypted at rest | AES-256-GCM EncryptionService with dual-key rotation | core/crypto/.../EncryptionService.java; Secrets |
| Secrets not in code or images | Env injection from deploy/compose/.env or Kubernetes Secrets; gitignored .env files; gitleaks secret scan in CI | deploy/compose/.env.example, .gitignore, scripts/ci/secret-scan.sh |
| Untrusted code sandboxing | mcp-stdio-runner (isolated network, no secrets, non-root, cap-drop, seccomp), tool-sandbox, command and URL guards | docs/architecture/MCP-STDIO-SANDBOXING-DESIGN.md §9; ADR-0009 |
| Security testing with remediation trail | Internal MCP pentest, core SAST and live DAST reviews; fixes landed in code | Internal security reviews (not published); Threat Model |
| Change management | Git and PR review; immutable Flyway migrations with a CI lint (edit guard, destructive DDL, version collision) | .github/workflows/static-gates.yml, scripts/ci/flyway-lint.sh |
| Payment webhook integrity (optional billing) | Provider signature verification with constant-time compare; durable dedupe ledger | Webhook controllers; V250__billing_webhook_event.sql |
| Abuse limits on anonymous surfaces | Signup, demo-session, device-claim limiters; Redis-backed with a local fallback | SecurityConfig.java comments; core/security/.../ratelimit/LocalRateLimitFallback.java |
| Human oversight of AI actions | Approval gating modes, operator handoff, guardrails | core/guardrails/.../ApprovalGateMode.java; Governance |
| Data-subject erasure (per channel contact) | POST /api/channels/pairing/erase-subject, tenant-admin gated, writes a masked audit entry | SecurityConfig.java matcher |
| DPDP-oriented: notice and consent step (opt-in per agent) | A channel contact gets the notice first; until they agree there is no model call, tool, memory write or stored message text. Consent, decline and withdrawal are recorded with notice version, language and purpose | ConsentGateService.java, ConsentLedger.java, V495__dpdp_oriented_controls.sql; DpdpControlsIT |
| DPDP-oriented: purpose tags | A knowledge collection tagged for one purpose is closed to an agent that does not carry it (agent knowledge tools only) | PurposeService.java, AgentKnowledgeToolResolver.java |
| DPDP-oriented: retention | Per-tenant and per-channel periods for transcripts, recordings and extracted memory, purged nightly with an audit event per purge; opt-in, default 365 days | RetentionPurger.java, RetentionPurgeJob.java |
| DPDP-oriented: per-contact export and erasure | POST /api/tenant/privacy/contacts/export and /erase; the response lists what was not reached (backups, provider copies, operational logs) | ContactPrivacyService.java |
| DPDP-oriented: audit export for breach response | GET /api/tenant/privacy/audit-export for a time range, with the signed seals; a runbook template | AuditExportService.java; breach runbook |
| Kill switches and status transparency | Tenant status guard, platform kill switch, public status endpoint | TenantStatusGuard.java, /api/public/status in SecurityConfig.java |
3. Gaps and operator responsibilities
| Item | State |
|---|---|
| Periodic access review | Operator policy; the code provides audit logs and role listings only |
| Incident response plan | Operator policy; see Observability and Rollback & Recovery for technical triage |
| Backup and restore | Documented pg_dumpall procedure for Compose and optional Windows helper scripts; CNPG or managed-Postgres backups on Kubernetes. Scheduling and a tested DR drill are the operator's job (Backup & Restore) |
| Vendor and model-provider review | Gap: no subprocessor list, DPAs or model cards ship with the project |
| Dependency and CVE scanning in CI | CodeQL on pull requests, pushes to main and weekly; dependency review and gitleaks inside CI; OpenSSF Scorecard weekly. Container image CVE scanning of your running deployment is the operator's job. |
| Central audit-log retention / SIEM | Gap: app logs, Loki and Grafana only (profile observability) |
| Business continuity / RTO-RPO targets | Operator decision; the Compose tiers are single-host, and core runs one API replica until the Helm replicaReadiness flags are all true |
| Data residency | DataResidencyRegion is informational only: it records a declared jurisdiction and does not route or move data. One Postgres instance per deployment. |
| Erasure completeness | Does not cover graph-memory entities, or LLM/tool call logs that quote a subject's text; there is tension with log-retention needs that needs a legal decision. No UI for erasure. |
| Guardrail effectiveness | Source describes the pattern implementation as modest and disclaims solving prompt injection or DLP; guardrails are configured per agent |
4. Security review history
| Date | Review | Method |
|---|---|---|
| 2026-07 | Data-governance review | Hand read of source; no build or run |
| 2026-07 | MCP security pentest | Static review, no live exploits; remediation landed in code |
| 2026-07 | Core SAST | Static review plus fixes verified by test |
| 2026-07 | Live DAST | Live requests against a running local stack |
| 2026-09 | Platform security audit | Fixes visible in code: azp check, actuator guard, voice-relay ticket, rate-limit fallback |
All reviews were internal, and their reports are not published; none is a third-party attestation. Report new vulnerabilities as described in SECURITY.md.
Evidence & references
core/security/.../DataResidencyRegion.java,SecurityConfig.java,AuditingAccessDeniedHandler.java;core/guardrails/.../GuardrailService.java.docs/architecture/MCP-STDIO-SANDBOXING-DESIGN.md..github/workflows/ci.yml,codeql.yml,static-gates.yml(triggers).