← Back to SecuritySOC 2 Compliance Roadmap
Trust Service Criteria alignment · Last updated: April 23, 2026
SOC 2 audit in preparation
Lexitio’s controls are designed to the SOC 2 Trust Service Criteria. Lexitio’s own SOC 2 audit is in preparation; Lexitio does not hold a SOC 2 report today. This page tracks our progress against each control.
CC1 — Control Environment
Security policy documentationIn Progress
Written security policies covering access control, data classification, incident response, and vendor management.
Security awareness trainingPlanned
Annual security training for all personnel with access to production systems.
Background checksPlanned
Background verification for personnel with access to customer data.
CC2 — Communication and Information
Security overview pageComplete
Public-facing security overview documenting controls, encryption, and data isolation.
Privacy PolicyComplete
Full privacy policy with subprocessor disclosure, data retention, and user rights.
BAA position publishedComplete
The /baa page states that Lexitio does not currently offer a Business Associate Agreement, and asks HIPAA-covered entities to contact us before putting protected health information into Lexitio.
Vulnerability disclosure policyComplete
Responsible disclosure program at security@lexitio.com.
CC3 — Risk Assessment
Annual risk assessmentPlanned
Formal identification and assessment of risks to confidentiality, integrity, and availability.
Threat modelingIn Progress
Documented threat model for the application and infrastructure.
CC6 — Logical and Physical Access
Role-Based Access ControlComplete
RBAC enforced at the API layer. Every endpoint requires explicit permission check.
Multi-factor authenticationComplete
MFA available for all accounts via TOTP.
API key scopingComplete
Programmatic access via scoped API keys (sk-lex_ prefix), hashed before storage.
JWT logout invalidationComplete
Logged-out JWT tokens are blocklisted and rejected on all subsequent requests.
Least privilege principleComplete
Production database accessible only from application containers; no public DB port.
Access reviewsPlanned
Quarterly review of user access rights and privilege escalations.
Privileged access managementIn Progress
Separate admin credentials for production systems; break-glass access documented.
CC7 — System Operations
Row Level Security (RLS)Complete
PostgreSQL RLS policies on all tenant-scoped tables — database-level tenant isolation.
Audit loggingComplete
Append-only audit log on every sensitive action; 7-year retention; accessible to firm admins.
Error monitoringComplete
Application error monitoring via Sentry with anomaly alerting.
Intrusion detectionComplete
Login rate limiting, account lockout, and anomalous access alerts.
Patch managementIn Progress
Documented process for applying security patches to OS, dependencies, and Docker images.
Dependency scanningPlanned
Automated scanning of Python and Node.js dependencies for known vulnerabilities.
CC8 — Change Management
Version controlComplete
All code changes tracked in Git with commit history and pull request review.
Database migration managementComplete
Alembic migrations with version control; no manual schema changes in production.
CI/CD pipelinePlanned
Automated build, test, and deployment pipeline with pre-deploy checks.
Rollback procedureIn Progress
Documented rollback procedure for failed deployments.
A1 — Availability
Daily backupsComplete
Automated daily pg_dump backups encrypted and shipped to Backblaze B2 (30-day retention).
Backup restore testingIn Progress
Periodic restore tests to verify backup integrity.
Uptime monitoringIn Progress
External uptime monitoring with alerting for availability degradation.
Incident response planIn Progress
Documented IR plan covering detection, containment, notification, and post-mortem.
C1 — Confidentiality
Encryption in transitComplete
TLS 1.2+ enforced on all connections. No plaintext HTTP allowed.
Encryption at restComplete
Server-side AES-256 on S3-compatible object storage; managed PostgreSQL encrypted at rest by the provider.
Tenant data isolationComplete
Application-level tenant_id filtering + PostgreSQL RLS on all tenant tables.
Data classification policyPlanned
Formal classification of data types and handling requirements.
P — Privacy (CCPA / HIPAA)
Privacy PolicyComplete
Full privacy policy with subprocessor list, retention schedule, and user rights.
CCPA Do Not Share pageComplete
California resident opt-out page and privacy rights request mechanism.
Data minimizationComplete
Only necessary data collected; no behavioral advertising or data brokering.
Enterprise security review
Need a completed security questionnaire, penetration test results, or a pre-certification review call? Contact enterprise@lexitio.com. Lexitio does not currently offer a Business Associate Agreement; please contact us before putting protected health information into Lexitio.