Search Results

OverviewThis document outlines the ElastiCache Redis configuration for the SMART360 production environment. The setup uses a single Redis cluster with multiple logical databases to serve different microservices for message brokering (Celery/Celery Beat) and ca...

OverviewThis document outlines the security architecture and configuration for the production PostgreSQL RDS instance, implementing a multi-layered security approach that restricts direct database access and enforces controlled connectivity through designated ...

OverviewThis guide provides two methods for accessing the production PostgreSQL database through the bastion host:DBeaver with SSH Tunnel - GUI-based database client with built-in SSH tunnelingCommand Line with Port Forwarding - Direct command-line access usin...

Test Scenario SummaryThis document contains comprehensive enhanced test cases for the System Admin Dashboard feature covering organization setup with weighted progress calculations, utility setup with 3-parameter formula, user adoption monitoring, security act...

Understanding the Difference:Certifications → Issued by an accredited third party after an audit. You get an official document we can show in sales/security reviews.Frameworks → No one “issues” a certificate (unless tied to another certification). You self-ali...

1. Primary focus = “In-scope systems”Production environment (AWS in our case) will definitely be in scope — because that’s where customer data is stored/processed. Development environments (GCP in your case) can also be in scope if they:Contain any real custom...

Technical Requirements (West Jordan Utah)Must be hosting in a U.S.-based data center Data encryption at rest and in transit Role-based access controls and audit logging Disaster recovery and business continuity plan API availability and documentation Support ...

1. What is SOC 2?SOC 2 (System and Organization Controls 2) is a security and trust compliance framework developed by the American Institute of Certified Public Accountants (AICPA).It focuses on the controls and processes a company uses to protect data, specif...

Stage 1 – Scoping & PlanningTimeframe: 2–3 weeksWork Involved:Define audit scope: services, systems, locations, and people involved.Include AWS production, Signoz observability in GCP, staging environment, and relevant SaaS vendors.Make necessary migrations, i...

Identity & Access ManagementUse IAM roles and policies — restrict permissions based on least privilege. COSTUse SSO (e.g., Okta, Google Workspace) if possible.Enable MFA for all critical accounts.Enforce password policies (rotation, complexity, reuse preventio...

SOC 2 Non-Technical Control Tasks1. Policy Creation & Documentation (may need help from Tech Team for this too)(Must be formal, dated, and approved — auditors will check version history)Information Security Policy – overall security approach, roles & responsib...

Manual vs VendorAspectManual ProcessVendor (Sprinto, Vanta, Drata, etc.)Policy CreationWrite policies from scratch (may adapt free templates). Needs legal/security review. Takes weeks.Pre-built, auditor-approved templates you customize in hours.Evidence Collec...

US and UK companies have tight rules for data security and privacy polices, the firms charge heavy fines and legal notices on SaaS vendors breaching any.Overview of what SOC 2 is about.Difference in SOC 2 Type 1 and SOC 2 Type, where they suggested SOC 1 Type ...

1. Builds Customer Trust and ConfidenceDirect Benefit: Demonstrates that you have strong data security, privacy, and integrity controls in place.Impact: Especially important if you handle PII (Personally Identifiable Information), financial data, or customer b...

Bottom Line Up FrontPostHog can be implemented safely for our B2B SaaS application, but requires careful configuration to protect sensitive customer data (SSN/DOB). The key risks are manageable with proper implementation.Compliance Standards Summary TableFrame...

https://posthog.com/docs/privacy/data-collection You can safely capture session replays events without compromising your users' privacy. PostHog offers a range of masking techniques that let you mask over sensitive information.The following masking techniques ...

Why should I be signing a DPA from them (posthog)?This is like, Privacy regulations like GDPR, CCPA, and many others worldwide require a formal agreement between you (the controller) and PostHog (the processor) to govern how this data is handled.Ensuring Legal...

1. What is “Product Security” in SaaS?Protecting customer data from breaches, misuse, or accidental loss.Covering both technology (encryption, access control, monitoring) and processes (policies, vendor checks, incident handling).Demonstrated via recognized ce...

1. SOC 2’s RequirementSOC 2 doesn’t dictate how your DR architecture should be built — it evaluates whether your systems and processes meet your stated commitments in the Availability and Processing Integrity criteria.If you commit in your policy that “we can ...

SOC 2-Driven Infra Cost Implications (Monthly)AreaChange NeededAWS ServicesEst. Additional Monthly CostNotesIdentity & Access Management (IAM)MFA for all IAM users, SSO (via AWS IAM Identity Center w/ Google Workspace), IAM Access AnalyzerAWS IAM Identity Cent...