> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lanesync.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# SOC 2 control mapping

> LaneSync security controls mapped to SOC 2 Trust Services Criteria — readiness document for enterprise procurement.

This document maps LaneSync's implemented controls to **SOC 2 Trust Services Criteria (TSC)**. It is a readiness artifact — formal SOC 2 Type II certification requires an independent auditor.

## CC6 — Logical and physical access controls

| Control                     | Implementation                            | Evidence                                                    |
| --------------------------- | ----------------------------------------- | ----------------------------------------------------------- |
| CC6.1 Logical access        | GitHub OAuth, session cookies, tenant RLS | `backend/src/middleware/auth.ts`, `schema.sql` RLS policies |
| CC6.1 Least privilege DB    | `sdlc_app` non-superuser role, FORCE RLS  | `backend/src/db/pool.ts`, `DB_ACCESS.md`                    |
| CC6.6 Encryption            | Envelope encryption AES-256-GCM, KMS KEK  | `backend/src/crypto/`, Terraform KMS module                 |
| CC6.7 Credential management | Secrets Manager for staging/prod secrets  | Terraform staging `main.tf`                                 |

## CC7 — System operations

| Control          | Implementation                            | Evidence                                    |
| ---------------- | ----------------------------------------- | ------------------------------------------- |
| CC7.2 Monitoring | CloudWatch metrics, Sentry error tracking | Terraform compute alarms, `@sentry/node`    |
| CC7.3 Audit logs | `audit_log` table, CloudTrail KMS events  | `backend/src/audit/`, KMS CloudTrail module |

## C1 — Confidentiality

| Control                               | Implementation                                               | Evidence                          |
| ------------------------------------- | ------------------------------------------------------------ | --------------------------------- |
| C1.1 Confidential data identification | CVE/SAST reports, metrics, stack traces classified           | `sensitive-fields.ts`, blob store |
| C1.2 Disposal                         | S3 lifecycle + retention policies (configure per tenant SLA) | Terraform storage module          |

## A1 — Availability

| Control       | Implementation                       | Evidence             |
| ------------- | ------------------------------------ | -------------------- |
| A1.2 Recovery | RDS automated backups, S3 versioning | Terraform RDS module |

## Contact

For the latest certification status or to request a full security questionnaire response: **[security@lanesync.dev](mailto:security@lanesync.dev)**