# Nabii.Space — SOC 2 Readiness Statement

**Status:** Self-attested. Nabii.Space is **not** currently SOC 2 Type I or Type II
certified. This document describes the controls Nabii.Space operates today,
mapped to the AICPA Trust Services Criteria, so buyers can evaluate the current
posture and plan around a future audit.

**Document owner:** Nabii.Space
**Last reviewed:** {{REVIEW_DATE}}
**Contact:** security@nabii.space

---

## Scope

Nabii.Space is a web application that assists writers with drafting, provenance
verification, and follow-through workflows. This statement covers the production
application, the managed backend (database, auth, storage, edge functions), and
the model gateways used to generate AI-assisted output.

## Trust Services Criteria — current controls

### Security (CC-series)

| Control | Current implementation |
|---|---|
| CC1 — Governance | Single founder-operator today; policies maintained in this repository. |
| CC2 — Communication | Security contact published at security@nabii.space; changes to this document are versioned in git. |
| CC5 — Logical access | Password + email verification via managed auth. Row-Level Security on every workspace table. Server-side role checks via `has_role()` for administrative surfaces. |
| CC6 — Access provisioning | User self-service sign-up. Role grants performed only by authenticated admins through `requireSupabaseAuth`-gated server functions. |
| CC7 — System operations | Automated deploys from git. Runtime error capture surfaces exceptions to the operator. Health endpoint at `/api/public/health`. |
| CC8 — Change management | All production changes are code-reviewed pull requests; database schema changes ship as versioned migrations. |
| CC9 — Risk mitigation | Subprocessor list published (see `subprocessors.md`) and reviewed on change. |

### Availability

- Hosted on managed edge infrastructure with provider-managed redundancy.
- Database backups are handled by the managed backend provider on their standard
  retention schedule.
- No published uptime SLA today. Best-effort operation; incident notification
  by email to affected customers within 72 hours of confirmation.

### Confidentiality

- TLS 1.2+ in transit for all client and server traffic.
- Encryption at rest via managed backend provider defaults.
- Secrets stored in the platform secret manager, never in source.
- Workspace content is scoped by RLS to the owning user and invited collaborators.

### Processing integrity

- Every AI-assisted output is run through a deterministic factual-integrity scan
  (`verifyDraft`) that blocks invented statistics, fabricated citations, and
  absolute claims before the draft is shown to the writer.
- IP-shield scan (`runIpShield`) flags overlap with the writer's prior drafts
  and, when the Firecrawl connector is linked, with the open web. High-risk
  matches hard-block approval.
- All AI-generated output is human-reviewed before it reaches any audience.

### Privacy

- Data minimization: only fields required to run the requested feature are stored.
- User content is never used to train foundation models.
- Export and delete available from Settings → Account.
- Data deletion completes within 30 days of request.
- See `dpa.md` for the executable data processing agreement.

## Gaps disclosed

The following controls are **not** in place today. Nabii.Space will disclose
progress on each item on request.

- No SOC 2 Type I or Type II report has been issued.
- No third-party penetration test on file for the current release.
- No 24/7 on-call rotation; incident response is best-effort during business hours.
- No formal Business Continuity / Disaster Recovery test on file.
- No documented Vendor Security Review process; subprocessor selection is
  documented in `subprocessors.md`.
- HIPAA BAA is **not** available at this time. Do not enter PHI into Nabii.Space.

## Roadmap

Nabii.Space is on a stated path to SOC 2 Type I within 12 months of the first
Regulated-tier customer and Type II within 12 months of Type I issuance.
Milestones are shared with contracted customers on request.

---

*This document is a factual description of current controls, not an audit
opinion. Do not represent Nabii.Space as SOC 2 certified.*