Every requirement, mapped to a control
PostMTA is SOC 2 aligned, HIPAA-ready, NIST CSF-mapped, and CIS Controls v8-compliant. This page shows the specific PMH-SEC control that satisfies each requirement — your auditor gets a real artifact, not a vendor checkbox.
PostMTA is "aligned" — not "certified." We do not hold a SOC 2 Type II certificate, ISO 27001 certificate, or C5 attestation. What we provide customers is the full evidence artifact package: PMH-SEC matrix, audit log schema, architecture diagram, and penetration test summary. Use these to build your own compliance narrative — your auditor will thank you.
Trust Service Criteria (TSC) mapping
CC1 — Control Environment
PostMTA maintains a formal security program with documented policies reviewed annually. The control environment is overseen by a named CISO and evidenced through board-level security minutes.
CC1.1 — Board Oversight
The PostMTA board receives quarterly security briefings covering incidents, risk posture, and control test results.
CC2 — Communication and Information
Security expectations are communicated via the employee handbook, contractor agreements, and the public trust.postmta.com site. Material changes are communicated to customers within 72 hours.
CC2.1 — Internal Control Communication
Control failures are routed through a JIRA security board with SLA tracking. Risk committee meets monthly.
CC3 — Risk Assessment
Annual enterprise risk assessment covering operational, reputational, and compliance risks. New risks are added on a quarterly cadence.
CC3.1 — Supply Chain Risk
Subprocessor security is reviewed annually. All subprocessors are contractually bound to PostMTA's security requirements.
CC4 — Monitoring Activities
Continuous monitoring via the observability stack (Loki + Grafana). Anomalous activity triggers PagerDuty alerts to the on-call security team.
CC5 — Control Activities
Role-based access enforced at the API gateway (SEC-002 Bearer JWT) and at the database row-level (SEC-003 Workspace Membership, SEC-004 Viewer Role Blocks Mutations).
CC5.1 — Technology Change Management
All production changes go through a CI/CD pipeline with automated test gates including PMH-SEC-036 (multi-tenant isolation) and PMH-SEC-037 (migration roundtrip). No direct production access for engineers.
CC6 — Logical and Physical Access Controls
Logical access uses short-lived JWTs with workspace and role scope. Physical access to data centers uses badge + biometric. All access logged to immutable audit trail.
CC6.1 — Authorization
Access follows least-privilege. Database role used by application has SELECT revoked on credentials table (SEC-011). API keys never returned after creation (SEC-008). SMTP passwords hashed with Argon2id (SEC-009).
CC6.2 — Multi-Tenant Isolation
PostMTA enforces multi-tenant isolation at the database row-level (SEC-003, SEC-004) and verified by the automated PMH-SEC-036 test before every deployment.
CC6.6 — Security for Confidential Information
SMTP credentials stored as Argon2id hashes (SEC-009). DKIM private keys stored in Vault accessible only via service_role (SEC-023). API key plaintext returned only once on creation (SEC-008).
CC7 — System Operations
Rate limits (SEC-007), reputation pulse (SEC-034), observability (SEC-030), and chaos testing (SEC-038) together cover system availability and operational resilience.
CC7.1 — Vulnerability Management
Dependency scanning via Dependabot on all repositories. Critical CVEs patched within 24 hours. Quarterly external penetration testing by Bishop Fox.
CC8 — Change Management
All changes to production infrastructure are applied through IaC (Terraform). No manual changes. CI/CD gates include security scan, PMH-SEC-036, and PMH-SEC-037.
CC9 — Risk Mitigation
Business continuity and disaster recovery plans documented and tested. GPG-signed backups (SEC-031), air-gap signed bundle (SEC-032), and RTO/RPO targets defined per tier.
A1 — Availability
99.99% uptime SLA on Enterprise. Availability is measured via the observability stack with a synthetic check on the primary API endpoint. Incidents trigger automatic severity classification.
HIPAA Safeguards mapping
Administrative Safeguards — § 164.308(a)(1)
Security Management Process (§ 164.308(a)(1)(ii)(A))
PMH: Risk assessment conducted annually. Risk treatment plan documented and tracked in JIRA security board. PMH-SEC-036 multi-tenant isolation test run on every deployment.
Assigned Security Responsibility (§ 164.308(a)(2))
PMH: Named CISO with documented responsibilities. Board receives quarterly security briefings.
Workforce Security (§ 164.308(a)(3))
PMH: Background checks required for all engineers with production access. Security awareness training required annually. Access removed within 24 hours of departure.
Information Access Management (§ 164.308(a)(4))
PMH: Role-based access enforced via JWT scope (SEC-002 Bearer JWT). Workspace-level isolation enforced at the API gateway (SEC-003 Workspace Membership). Viewer role blocks all mutations (SEC-004).
Security Awareness Training (§ 164.308(a)(5))
PMH: Annual security awareness training for all staff. Phishing simulation exercises run quarterly. Completion tracked in HR system.
Security Incident Procedures (§ 164.308(a)(6))
PMH: Documented incident response plan with 15-minute acknowledgment SLA for critical incidents. Breach notification within 72 hours per GDPR Article 33 / HIPAA Breach Notification Rule.
Contingency Plan (§ 164.308(a)(7))
PMH: Business continuity and disaster recovery plans tested annually. GPG-signed backups (SEC-031), air-gap signed bundle (SEC-032), chaos failure injection testing (SEC-038). RTO/RPO defined per tier.
Physical Safeguards — § 164.310
Facility Access Controls (§ 164.310(a)(1))
PMH: Data centers (AWS, GCP) enforce badge + biometric access. Physical access logs retained for 1 year. Visitor access requires escort.
Workstation Use (§ 164.310(b))
PMH: PostMTA-managed workstations only. Endpoint detection and response (EDR) deployed on all company devices. Disk encryption required.
Device and Media Controls (§ 164.310(d)(1))
PMH: Hardware朽化管理: lost/stolen devices remote-wiped within 4 hours of report. Media containing PHI-equivalent data physically destroyed per NIST SP 800-88.
Technical Safeguards — § 164.312
Access Control (§ 164.312(a)(1))
PMH: JWT-based authentication (SEC-002 Bearer JWT). MFA available as optional second factor (SEC-006). OIDC/SAML SSO for Enterprise with MFA enforced at IdP (SEC-035).
Audit Controls (§ 164.312(b))
PMH: Append-only audit log (SEC-012) covering all send attempts, credential changes, and membership changes (SEC-013). Logs retained 90 days hot, 7 years cold.
Integrity (§ 164.312(c)(1))
PMH: DKIM signing for all outbound mail (SEC-023, SEC-024). SPF and DMARC enforced at the domain verification step (SEC-026). Audit log is append-only with no delete/update path.
Transmission Security (§ 164.312(e)(1))
PMH: TLS 1.2/1.3 required for all API and SMTP connections (SEC-018, SEC-019). ACME-issued certificates renewed automatically (SEC-020). STARTTLS opportunistic with reject on failure for production targets.
NIST Cybersecurity Framework mapping
Identify
Protect
Detect
Respond
Recover
Identify
Physical devices and systems are inventoried
PMH: All production hosts inventoried in Terraform state. Network boundaries documented. CMDB updated by IaC on every provision.
Software platforms and applications are inventoried
PMH: Software bill of materials (SBOM) generated on every build. Dependencies tracked via Dependabot with CVE alerting.
Organization's role in the supply chain is identified
PMH: Subprocessor list maintained and reviewed annually. All subprocessors contractually bound to PostMTA security requirements.
Assets and threats are identified and documented
PMH: Annual enterprise risk assessment. PMH-SEC matrix maps each identified risk to a control with an owner and evidence reference.
Legal and regulatory requirements regarding cybersecurity are understood and managed
PMH: GDPR, HIPAA, CCPA requirements tracked in the compliance register. Legal review of new product features.
Protect
Identities and credentials are issued, managed, verified, revoked, and audited
PMH: JWT-based auth (SEC-002). Workspace membership scope enforced at API gateway (SEC-003). API keys returned once on creation (SEC-008). SMTP passwords hashed Argon2id (SEC-009). Audit log append-only (SEC-012).
Access permissions are managed, incorporating the principles of least privilege
PMH: Viewer role blocks all mutations (SEC-004). Editor+ required for send (SEC-005). Credit grant restricted to admin/owner (SEC-017). Database SELECT revoked on credentials (SEC-011).
Network integrity is protected
PMH: CORS allowlist (SEC-001). TLS required for production SMTP (SEC-019). ACME certificate renewal (SEC-020). DKIM keys scoped per workspace (SEC-024).
Data-at-rest is protected
PMH: AES-256 encryption at rest on all storage. Credentials in Vault (SEC-023). Database encryption enabled for all RDS instances.
Data-in-transit is protected
PMH: TLS 1.2/1.3 for all API and SMTP connections (SEC-018, SEC-019). STARTTLS enforced with reject on failure for production. Webhook payloads HMAC-signed (SEC-033).
A baseline configuration of systems is created and maintained
PMH: All infrastructure as code via Terraform. No manual changes to production. Baseline configuration enforced via CI/CD.
Maintenance and repair of organizational assets is performed and logged
PMH: Maintenance windows scheduled with customer notice. All changes through CI/CD. Audit log captures all changes (SEC-012, SEC-013).
Audit/log records are determined, documented, and implemented
PMH: Append-only audit log (SEC-012). Events: send attempts, API key lifecycle, membership changes, credential grants/revocations (SEC-013). 90-day hot retention, 7-year cold.
Removable media is protected
PMH: Air-gap signed backup bundle (SEC-032). No removable media in production. Hardware key management via HSM for backup signing.
Detect
The network is monitored for unauthorized activity
PMH: Observability pack (SEC-030) covering all network flows. Anomalous traffic patterns trigger PagerDuty alerts.
Malicious code is detected and prevented
PMH: Dependency scanning (Dependabot). EDR on all company endpoints. Penetration testing by Bishop Fox quarterly.
Monitoring for unauthorized personnel, connections, devices, and software is performed
PMH: Observability pack with workspace-level metrics (SEC-030). Rate limit enforcement (SEC-007). Reputation pulse (SEC-034).
Event detection and analysis is performed
PMH: Structured JSON logs to Loki (SEC-030). Anomaly detection via Grafano alerting rules. Alert routing to on-call security team via PagerDuty.
Respond
Analysis is conducted to verify and understand events
PMH: Immutable audit log (SEC-012) available for forensic analysis. Observability pack supports event correlation (SEC-030).
Incidents are contained
PMH: Incident response plan with documented containment procedures. Multi-tenant isolation test (SEC-036) prevents lateral movement between workspaces.
Incident response plan is executed during or after an incident
PMH: IR plan executed for all Severity 1 incidents. 15-minute acknowledgment SLA. Post-incident review within 5 business days.
Personnel know their roles and order of operations during an incident
PMH: IR plan with RACI matrix. Annual tabletop exercise. On-call rotation with documented escalation path.
Recover
Recovery plan is executed during or after a disruption
PMH: Disaster recovery plan documented and tested annually. GPG-signed backups (SEC-031). Air-gap signed bundle (SEC-032). RTO/RPO targets defined per tier.
Recovery plans incorporate lessons learned
PMH: Post-incident reviews feed into the risk register and PMH-SEC matrix. Lessons learned documented in the security wiki.
Recovery plans are communicated to internal and external parties
PMH: Customer notification within 72 hours for confirmed breaches. Status page updated during active incidents. Post-incident reports available to affected customers.
CIS Controls v8 mapping (selected safeguards)
CIS Control 3 — Data Protection
AES-256 at rest, TLS 1.3 in transit (SEC-018, SEC-019). Credentials hashed Argon2id (SEC-009). DKIM keys in Vault (SEC-023). API keys never returned after creation (SEC-008). Append-only audit (SEC-012).
CIS Control 4 — Secure Configuration
All infrastructure as code (Terraform). No manual production changes. Baseline configuration enforced in CI/CD. Immutable audit log (SEC-012).
CIS Control 5 — Account Management
JWT with workspace and role scope (SEC-002, SEC-003). Viewer role blocks mutations (SEC-004). MFA available (SEC-006). OIDC/SAML for Enterprise (SEC-035). Audit on membership changes (SEC-013).
CIS Control 6 — Access Control
RBAC enforced at API gateway (SEC-003, SEC-005). DB row-level security (SEC-004). Credit grant restricted to admin/owner (SEC-017). SELECT revoked on credentials table (SEC-011).
CIS Control 7 — Continuous Vulnerability Management
Dependabot for dependency scanning. Quarterly pen test by Bishop Fox. PMH-SEC-036 isolation test gates every deployment. Observability (SEC-030) for runtime anomaly detection.
CIS Control 8 — Audit Log Management
Append-only audit (SEC-012). Events: send, keys, grants, membership changes (SEC-013). 90-day hot retention, 7-year cold. Immutable — no UPDATE or DELETE path.
CIS Control 11 — Data Recovery
GPG-signed backups (SEC-031). Air-gap signed bundle (SEC-032). RTO/RPO defined per tier. Chaos injection testing (SEC-038). Backup restoration tested annually.
CIS Control 14 — Security Awareness Training
Annual security awareness training for all staff. Phishing simulations quarterly. Documented in HR system with completion tracking.
Request the full evidence package
The complete SOC 2 artifact package, HIPAA BAA, PMH-SEC matrix, and penetration test summary — available to customers under NDA. Fill in /contact and tell us what you need.
Request Evidence Package