This page maps the controls described across this section to the two frameworks vendor reviews ask about most: the AICPA SOC 2 Trust Services Criteria (2017, with the 2022 points of focus) and ISO/IEC 27001:2022 Annex A. One tile per criterion or control; select a tile to see what is in place today, what is missing, and where the public evidence lives. The same facts appear under both frameworks, because the two overlap heavily.
It is Kumkuat's own assessment of the platform as it runs today, not an auditor's opinion. Kumkuat does not hold a SOC 2 report or an ISO 27001 certificate; see Compliance attestations. Nothing on this page is forward-dated.
Annex A lists the controls. Certification also audits the management system itself, clauses 4 to 10. This is where the largest gaps are.
Clause 4Context of the organisation✓ In placeA written scope statement and an interested-parties analysis exist in the Risk Assessment and Treatment Plan (version 1.3), approved at the first management review.
Clause 5Leadership✓ In placeThe CTO issues the policy set and notifies the company; roles and responsibilities defined.
Clause 6Planning✓ In placeRisk Assessment and Treatment Plan with 19 risks, 5 fraud risks, owners, treatments and approved target dates (version 1.3); exceptions register with risk ratings; vendor tiering.
Clause 7Support◐ PartialTraining and awareness required; documents version-controlled. Competence and training records not yet on file.
Clause 8Operation✓ In placeControls operate as described on this map; the treatment plan is issued and approved, with owners and target dates for each treatment.
Clause 9Performance evaluation◐ PartialMeasures are defined (Risk Assessment section 7.1) and the quarterly access reviews, dependency-alert deadlines, restore tests and alerting they draw on operate today. An Internal Audit Programme is issued and the first management review is complete. No internal audit has been performed yet.
Clause 10Improvement◐ PartialExceptions register tracks gaps with owners; incidents get a blameless review; a nonconformity and corrective-action log has been started. No corrective action closed yet.
Kumkuat has no office that holds customer data and owns no servers. Physical security, environmental protection, hardware lifecycle, the network fabric and clock synchronisation are provided by Google Cloud and covered by Google's own audits. Tiles marked G inherit that coverage. Everything above the infrastructure layer is Kumkuat's responsibility and is assessed on its own merits.
The gaps a reviewer will find on this map, in one list. Each is tracked in the Information Security Policy's exceptions register with a named owner. Target dates are shared on request.
Multi-factor authentication for email-and-password sign-in. Today MFA applies through your own identity provider over SAML 2.0. Organisations that require MFA should require single sign-on.
Independent penetration test. None completed. Releases are gated by a test suite of more than 6,000 tests and a manual approval.
Static analysis of application code. Dependency vulnerability alerts and automatic security-update pull requests are on (GitHub Dependabot). Static analysis of the code itself is not running.
Session hardening. A browser sign-in lasts up to seven days with no idle timeout, and API keys do not expire on their own. Keys can be revoked by a workspace admin at any time.
Customer-exportable audit log. Model-provider calls are logged per workspace internally. No customer-facing audit log or SIEM export exists.
Resilience beyond one zone. The database is a single Cloud SQL instance with daily backups and point-in-time recovery. No standby instance and no cross-region failover.
Management-system evidence. Policies exist and are reviewed annually. The risk assessment now includes a fraud analysis and performance measures, an internal-audit programme is issued, and the first management review is complete. Policies are issued by the CTO and notified to the company on the day they are updated. The first internal audit is pending.
Personnel screening. A screening standard is issued in the security policy. No background verification has been performed or recorded.
Data leakage prevention. Uploads are private by default with signed URLs, and public access prevention is enforced on two of three storage buckets. No data-loss-prevention tooling on laptops or in email.