Compliance Summary

This page summarizes the current VaultCrux compliance posture for customer and procurement conversations.

Scope

• Applies to the Sprint 2 team-seats bridge scope (seat sessions, manual invites, webhook-ready billing metering).
• Covers current production controls, not deferred backlog items.

Compliance bundle pages

• Security Whitepaper
• DSAR Procedure
• Offboarding Runbook
• Receipt Verification

Core control posture

• Data ownership: customer data remains tenant-scoped in VaultCrux.
• Training policy: VaultCrux does not train foundation models on customer data.
• Integrity: response evidence uses signed receipts/proofpack workflows for auditable chains.
• Security controls: Shield policy stack is active in production with strict gate coverage.
• Operational contracts: /healthz, /readyz, and /metrics remain mandatory service interfaces.

Identity and access controls

• Team access is seat-based (owner, admin, member, viewer) with role-based route enforcement.
• Browser auth supports secure HttpOnly frontdoor sessions for API-key and seat-session users.
• Seat invite acceptance is token-based and one-time by design; invite handling is manual handoff in this sprint.
• Offboarding path supports seat revoke + seat-session invalidation.

Billing and metering posture

• Team billing defaults are provider-ready and Paddle-first naming:
  • included seats: 10
  • overage seat price: GBP 19
• Sprint 2 billing scope is metering/event-readiness:
  • seat.accepted
  • seat.revoked
  • seat.role_changed
  • seat.snapshot
• Live provider-side seat mutation/proration sync is deferred backlog.

Data protection narrative

• Encryption posture includes application-layer controls integrated with Vault-backed runtime secrets.
• Evidence integrity includes signed payloads and deterministic audit surfaces.
• Revocation/offboarding controls remove seat access and revoke session continuity.
• Regional/data handling alignment follows the current hosted operating model and documented retention controls.

Deferred items (explicit)

• SMTP invite delivery (manual handoff remains policy in Sprint 2).
• MCP seat management tools.
• Provider write-path seat sync and proration automation.
• Full user-account identity model beyond seat sessions.