> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Readiness snapshot

> The one-page executive view of our security and compliance readiness — updated quarterly.

<Info>
  Last updated **April 19, 2026**. See [SOC 2 & ISO 27001 readiness](/trust/soc2-iso27001) for the detailed breakdown of every control.
</Info>

## Recent progress

Since the April 2026 initial audit, the following findings moved to **remediated** or **code-closed**:

| Finding                                  | Status                                  | Evidence                                                                                                                             |
| ---------------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| **B** — PHI column encryption            | Code closed; staging backfill scheduled | PR #78 — backfill tasks for `OverturnableDenial` + `ProviderPatientLink`                                                             |
| **G** — JWT dual-secret rotation         | Closed                                  | PR #76 — `jwt.rotation_secret` wired; specs prove dual-secret verification                                                           |
| **H** — Org policies gated off           | Closed for staging                      | PR #77 + manual apply; `iam.disableServiceAccountKeyCreation` + `iam.disableServiceAccountKeyUpload` both `enforce: true` on staging |
| **E** — Formal security policies missing | Drafted and published                   | 10 new policy pages in this Trust Center + ISP/AUP/risk register v1.0                                                                |

## Overall maturity

<Card title="47 / 100 — Level 2: Repeatable Technical Controls" icon="gauge-high">
  Denialbase has built a technically strong security foundation — field-level encryption, CMEK key management, VPC-isolated infrastructure, HIPAA audit logging, multi-factor authentication, and an automated CI/CD security pipeline.

  However, this evidence is almost entirely technical and code-level. ISO 27001 certification requires a documented, operational ISMS with risk registers, policies, governance records, supplier agreements (BAAs), internal audits, and management reviews — none of which are evidenced today.

  With focused governance and documentation effort, our estimated gap to audit-readiness is **6–9 months**.
</Card>

## By category

| Category                | Score        | Status                                                                                            |
| ----------------------- | ------------ | ------------------------------------------------------------------------------------------------- |
| Technical security      | **78 / 100** | Encryption, auth, network, CI/CD security, secrets — all well implemented.                        |
| Operations & monitoring | **71 / 100** | Structured logging, HIPAA audit logs, PHI scrubbing, Sentry, DR and backup plans documented.      |
| Supplier security       | **22 / 100** | BAA tracker exists but no BAAs signed with GCP, Anthropic, Sentry, SES yet.                       |
| HR / incident response  | **18 / 100** | No incident response runbook, no HR security policy, no onboarding/offboarding records evidenced. |
| Governance & policies   | **12 / 100** | No ISMS policy, no risk register, no Statement of Applicability, no management review records.    |
| Risk management         | **10 / 100** | No formal risk assessment, risk treatment plan, or risk acceptance records.                       |

## Findings at a glance

| Severity | Count | Disposition                            |
| -------- | ----- | -------------------------------------- |
| Critical | 4     | Must resolve before audit window opens |
| High     | 9     | Must resolve before Type I opinion     |
| Medium   | 11    | Address within 90 days of audit start  |
| Low      | 6     | Best practice; address in roadmap      |

## Primary strengths

<CardGroup cols={2}>
  <Card title="CMEK everywhere" icon="key">
    Customer-managed encryption keys on Cloud SQL, GCS, Redis, and Terraform state — with 90-day automatic rotation.
  </Card>

  <Card title="Pundit + HIPAA audit" icon="shield-check">
    48 policy files with globally enforced object-level authorization. Every PHI action is audit-logged with 7-year retention.
  </Card>

  <Card title="WIF + Cloud Armor" icon="lock">
    Workload Identity Federation means zero long-lived CI/CD keys. Cloud Armor enforces OWASP CRS v3.3 at the edge.
  </Card>

  <Card title="Hardened auth" icon="fingerprint">
    MFA, passkeys, account lockout, 12-char password policy, rate limiting on every sensitive endpoint.
  </Card>
</CardGroup>

## Open gaps

<CardGroup cols={2}>
  <Card title="No BAAs signed" icon="file-contract" href="/trust/baa">
    GCP, Anthropic, Sentry, SES. Targeted for Q3 2026.
  </Card>

  <Card title="No Incident Response Plan exercised" icon="siren" href="/trust/incident-response">
    Formal IRP documented; tabletop exercise targeted for Q2 2026.
  </Card>

  <Card title="No DR test evidence" icon="rotate-left" href="/trust/disaster-recovery">
    Runbook documented; first drill targeted for Q2 2026.
  </Card>

  <Card title="No penetration testing" icon="bug" href="/trust/penetration-testing">
    First third-party pentest targeted for Q3 2026.
  </Card>

  <Card title="Org policies — prod pending" icon="toggle-on">
    Live in staging since April 19, 2026. Prod promotion targeted after 1–2 week staging soak.
  </Card>
</CardGroup>

## Remediated since the initial audit

<CardGroup cols={2}>
  <Card title="PHI column encryption" icon="circle-check">
    **Code closed** — backfill tasks for `OverturnableDenial` + `ProviderPatientLink` shipped in PR #78. Staging backfill scheduled.
  </Card>

  <Card title="JWT rotation mechanism" icon="circle-check">
    **Closed** — `jwt.rotation_secret` wired in PR #76; dual-secret verification covered by specs.
  </Card>

  <Card title="Formal security policies" icon="circle-check">
    **Published** — ISP, AUP, risk register v1.0 + 9 supporting policies. Pending CEO sign-off.
  </Card>

  <Card title="Statement of Applicability" icon="circle-check">
    **Published** — 93 of 97 ISO 27001:2022 Annex A controls mapped with per-control status and evidence.
  </Card>
</CardGroup>

## What this is, and isn't

<Warning>
  This snapshot is based on a structured review of source code, infrastructure-as-code, CI/CD definitions, documentation, and configuration files. **It is not an audit opinion.** No live production systems, GCP consoles, runtime logs, or access review artifacts were directly inspected. All findings reflect evidence observable in the code repository as of April 2026.
</Warning>

For a full deep-dive, request the complete readiness report (mutual NDA required): [security@denialbase.com](mailto:security@denialbase.com).