SOC 2 control mapping - LaneSync

This document maps LaneSync’s implemented controls to SOC 2 Trust Services Criteria (TSC). It is a readiness artifact — formal SOC 2 Type II certification requires an independent auditor.

CC6 — Logical and physical access controls

Control	Implementation	Evidence
CC6.1 Logical access	GitHub OAuth, session cookies, tenant RLS	`backend/src/middleware/auth.ts`, `schema.sql` RLS policies
CC6.1 Least privilege DB	`sdlc_app` non-superuser role, FORCE RLS	`backend/src/db/pool.ts`, `DB_ACCESS.md`
CC6.6 Encryption	Envelope encryption AES-256-GCM, KMS KEK	`backend/src/crypto/`, Terraform KMS module
CC6.7 Credential management	Secrets Manager for staging/prod secrets	Terraform staging `main.tf`

CC7 — System operations

Control	Implementation	Evidence
CC7.2 Monitoring	CloudWatch metrics, Sentry error tracking	Terraform compute alarms, `@sentry/node`
CC7.3 Audit logs	`audit_log` table, CloudTrail KMS events	`backend/src/audit/`, KMS CloudTrail module

C1 — Confidentiality

Control	Implementation	Evidence
C1.1 Confidential data identification	CVE/SAST reports, metrics, stack traces classified	`sensitive-fields.ts`, blob store
C1.2 Disposal	S3 lifecycle + retention policies (configure per tenant SLA)	Terraform storage module

A1 — Availability

Control	Implementation	Evidence
A1.2 Recovery	RDS automated backups, S3 versioning	Terraform RDS module

Contact

For the latest certification status or to request a full security questionnaire response: security@lanesync.dev