142 / 197
CCM v4 controls implemented today, across 17 domains
The remaining controls are largely formal policy documentation and third-party attestation we are actively building. We list them transparently below rather than claim them.
Our approach
The CCM v4 is the Cloud Security Alliance's control framework; the CAIQ is the questionnaire that maps a provider's answers onto it. We answered every one of the 197 controls with a straight Yes or No, and wrote a specific implementation note for each.
Where a control is inherited from a provider (for example, physical datacenter security from AWS and Vercel), we say so. Where we operate a control but have not yet written the formal policy behind it, we mark it honestly and put it on the roadmap rather than claim it.
Coverage by domain
All 17 CCM v4 domains, ordered by current coverage. Strongest first.
Where we are strong
The controls that protect your data day to day are implemented and enforced in code, not just documented:
- Identity & access (15/16): role-based access enforced at the database row level via Postgres policies, field-level masking per role, MFA on all administrative access.
- Data security & privacy (17/19): single-tenant isolation per customer, classification-driven masking, customer-owned data with export and deletion on request.
- Logging & monitoring (13/13): every sensitive read and write logged with user, timestamp, and action.
- Supply chain (14/14): a published sub-processor list, each bound by data processing terms, with 30 days notice of changes.
- Change control (8/9) and infrastructure (8/9): all changes version-controlled and released canary-first; single-tenant, provider-hardened infrastructure.
What is on the roadmap
We are transparent about what we have not done yet:
- Independent attestation: we are not yet SOC 2 attested, and have not yet commissioned a third-party penetration test. Our underlying providers (Supabase, Vercel on AWS) are SOC 2 Type II certified.
- Formal policy documentation: several controls we operate today (business continuity, cryptography, governance and risk, human resources, endpoint) are not yet backed by written policies. The practice exists; the documentation is being formalized.
- Central endpoint management: team devices enforce full-disk encryption, automatic screen lock, current operating systems, and endpoint protection; a managed MDM with remote wipe is on the roadmap.
We will not claim a control we do not operate. If your security team needs a specific item, tell us and we will be straight about whether we meet it today, when we plan to, or whether we are not the right fit yet.
Request the full assessment
The completed CAIQ v4 workbook, with our answer and implementation note for every one of the 197 controls, is available to prospects and customers on request.