Compliance
Certification roadmap in progress
This page documents the security controls already in place today and the planned certification roadmap. Formal evidence packages (SOC 2, ISO 27001, GDPR, EU AI Act) are being assembled as each certification is pursued.
Overview
Proxima Console's compliance certification roadmap is phased to unlock markets progressively. This page will document how the platform's security controls map to each framework's requirements.
Certification Roadmap
| Phase | Certifications | Target Market | Status |
|---|---|---|---|
| 1 | SOC 2 Type I + GDPR + EU AI Act classification | US enterprise SaaS + EU market entry | Planned |
| 2 | SOC 2 Type II + ISO 27001 | European / MENA / Asia enterprise | Planned |
| 3 | ISO 42001 + PCI DSS (if deal-critical) | Financial sector + AI-forward enterprises | Planned |
Existing Security Controls
The following features already address key compliance requirements across multiple frameworks:
Identity & Access Management
| Control | Implementation | Frameworks |
|---|---|---|
| Per-user authentication | JWT + MFA (TOTP) + Google OIDC SSO | SOC 2 CC6.1, ISO 27001 A.9 |
| Role-based access control | RBAC with per-client scoping, permission-gated UI | SOC 2 CC6.3, ISO 27001 A.9.4 |
| Per-host agent identity | NATS JWT with Ed25519 nkey pairs, one-time install tokens | SOC 2 CC6.1, ISO 27001 A.9.2 |
| Password policy | NIST 800-63B (12+ chars, 10K blocklist, 5-password history) | SOC 2 CC6.1, ISO 27001 A.9.3 |
| Progressive lockout | Escalating durations (1min–1h) after failed attempts | SOC 2 CC6.1, ISO 27001 A.9.4 |
Data Protection
| Control | Implementation | Frameworks |
|---|---|---|
| Transport encryption | TLS 1.2+ on all NATS connections, HTTPS for API | SOC 2 CC6.7, ISO 27001 A.10.1 |
| Secrets management | HashiCorp Vault (PKI + KV v2), AppRole auth | SOC 2 CC6.1, ISO 27001 A.10.1 |
| Tenant isolation | Per-client VictoriaMetrics accounts, SQL-level client filtering, NATS JWT subject scoping | SOC 2 CC6.3, ISO 27001 A.9.4 |
| Instant revocation | Host revocation via NATS account JWT push | SOC 2 CC6.2, ISO 27001 A.9.2 |
Audit & Monitoring
| Control | Implementation | Frameworks |
|---|---|---|
| Audit logging | Append-only audit_log table (auth, admin, lifecycle events) | SOC 2 CC7.2, ISO 27001 A.12.4 |
| Observability | OpenTelemetry tracing, Prometheus metrics, VictoriaLogs | SOC 2 CC7.1, ISO 27001 A.12.4 |
| Agent liveness | Stale detection with configurable timeout | SOC 2 CC7.1, ISO 27001 A.12.1 |
| Container scanning | Trivy in CI (blocks on HIGH/CRITICAL) | SOC 2 CC8.1, ISO 27001 A.14.2 |
Planned Documentation
The following sections will be added as each certification is pursued:
SOC 2
- Trust Services Criteria mapping (CC1–CC9)
- Control descriptions and evidence inventory
- Continuous monitoring procedures
- Vendor management (sub-processors)
ISO 27001
- Statement of Applicability (SoA) — Annex A control mapping
- Information Security Management System (ISMS) scope
- Risk assessment methodology
- Business continuity and disaster recovery
GDPR
- Data processing activities register
- Data retention and deletion policies
- Data subject rights implementation
- Sub-processor list and DPA requirements
- Cross-border data transfer mechanisms
EU AI Act
- AI system classification (for the MCP server and AI chat features)
- Risk categorization
- Transparency and documentation requirements
PCI DSS (if applicable)
- Cardholder data environment scope
- Network segmentation
- Access control requirements
References
- NATS Security — Agent authentication and transport security
- Security Practices — Development security standards
- Authentication — Backend auth architecture
- Detailed timeline and cost analysis:
proxima-security-compliance.docx(internal)