Overview
This document maps HeliosDB-Lite’s security controls to SOC 2 Trust Services Criteria, demonstrating readiness for SOC 2 Type II certification.
Trust Services Criteria Mapping
CC1: Control Environment
Criteria Control HeliosDB Implementation Evidence CC1.1 Commitment to integrity and ethical values Code of Conduct, Contribution Guidelines Code of conduct and contribution guidelines CC1.2 Board oversight Governance documentation Governance documentation (internal) CC1.3 Management establishes structures Organizational structure Governance documentation (internal) CC1.4 Commitment to competence Hiring and training policies HR documentation CC1.5 Accountability enforcement Performance management HR documentation
Criteria Control HeliosDB Implementation Evidence CC2.1 Internal communication Internal documentation Internal documentation set CC2.2 External communication Public documentation, API docs Public documentation , REST API reference CC2.3 Security policies communicated Security documentation Security policy , compliance documents
CC3: Risk Assessment
Criteria Control HeliosDB Implementation Evidence CC3.1 Risk identification Threat modeling, risk register Risk register (internal) CC3.2 Risk analysis Security assessments Security audit reports CC3.3 Fraud risk consideration Security controls Security policy CC3.4 Change impact assessment Change management process Change management policy
CC4: Monitoring Activities
Criteria Control HeliosDB Implementation Evidence CC4.1 Ongoing monitoring Logging, metrics, alerting Built-in tracing, metrics CC4.2 Deficiency evaluation Incident management Incident response plan (internal)
CC5: Control Activities
Criteria Control HeliosDB Implementation Evidence CC5.1 Selection of controls Risk-based control selection Security architecture docs CC5.2 Technology controls Technical implementation Source code, configurations CC5.3 Policies and procedures Documented procedures Compliance and enterprise documentation
CC6: Logical and Physical Access Controls
Criteria Control HeliosDB Implementation Evidence CC6.1 Access to infrastructure Role-based access Access control policy CC6.2 System access registration User provisioning Authentication system CC6.3 Access removal Deprovisioning process Access control procedures CC6.4 Access review Periodic access reviews Audit logs CC6.5 Access authentication Strong authentication TLS, JWT, password policies CC6.6 Access protection Encryption in transit/at rest TDE, TLS 1.3 (ZKE planned) CC6.7 Transmission encryption TLS implementation rustls configurationCC6.8 Destruction of data Secure deletion Zeroize library
CC7: System Operations
Criteria Control HeliosDB Implementation Evidence CC7.1 Vulnerability detection Security scanning CI/CD pipeline CC7.2 Incident monitoring Logging and alerting Tracing infrastructure CC7.3 Security analysis Log analysis Operational runbooks (internal) CC7.4 Incident response IR procedures Incident response plan (internal) CC7.5 Recovery from incidents Recovery procedures Disaster recovery plan
CC8: Change Management
Criteria Control HeliosDB Implementation Evidence CC8.1 Change authorization PR approval process GitHub branch protection CC8.2 Change testing CI/CD testing GitHub Actions workflows CC8.3 Change deployment Release process Release process (internal)
CC9: Risk Mitigation
Criteria Control HeliosDB Implementation Evidence CC9.1 Vendor management Dependency management Dependency manifest, license review CC9.2 Business continuity BC/DR plans Business continuity plan (internal)
Security Controls Summary
Authentication & Authorization
┌─────────────────────────────────────────────────────────────────┐
├─────────────────────────────────────────────────────────────────┤
│ Client → TLS 1.3 → PostgreSQL Auth → Row-Level Security │
│ │ • Password │ (Argon2id/PBKDF2 hashed) │
│ │ • SCRAM-256 │ (PostgreSQL compatible) │
│ │ • JWT │ (HS256, REST API) │
└─────────────────────────────────────────────────────────────────┘
Encryption Architecture
┌─────────────────────────────────────────────────────────────────┐
├─────────────────────────────────────────────────────────────────┤
│ Layer 1: Transit TLS 1.3 (ECDHE + AES-256-GCM) │
│ Layer 2: TDE AES-256-GCM (server-managed keys) │
│ Layer 3: ZKE client-managed keys (planned) │
│ Layer 4: Field-Level Per-column encryption (optional) │
└─────────────────────────────────────────────────────────────────┘
Audit Logging (Planned)
Built-in audit logging is planned for HeliosDB Lite; the table lists the events it will
record. Until it is available, record changes to sensitive tables with triggers (see
Audit Logging ) and keep the server logs.
Event Type Logged Fields Retention Authentication User, timestamp, IP, result 90 days Authorization User, resource, action, result 90 days Data Access User, table, query type, timestamp 30 days Schema Changes User, DDL statement, timestamp 1 year Admin Actions User, action, parameters, timestamp 1 year
Gap Analysis
Available Today
Encryption at rest (TDE)
Encryption in transit (TLS 1.3)
Authentication (multiple methods)
Row-level security
Secure key management
Change management (PR process)
Vulnerability scanning (static analysis, cargo-audit)
In Progress
SOC 2 Type II audit engagement
Penetration testing (annual)
Security awareness training documentation
Vendor risk assessment process
Planned
Built-in audit logging
Security Operations Center (SOC) monitoring
Bug bounty program
Third-party security audit
ISO 27001 certification
Evidence Collection
Automated Evidence
Evidence Type Collection Method Storage Access logs Application logging Log aggregation service Change history Git commits GitHub Test results CI/CD pipeline GitHub Actions Vulnerability scans cargo-audit CI/CD artifacts Code reviews Pull request reviews GitHub
Manual Evidence
Evidence Type Collection Method Frequency Policy reviews Annual review cycle Annually Access reviews Manual audit Quarterly Risk assessments Security team review Annually Penetration tests Third-party engagement Annually
Audit Preparation Checklist
Pre-Audit (3 months before)
During Audit
Post-Audit
For SOC 2 compliance inquiries:
