# Security Annex — Immigration Document QC (TEMPLATE)

> Attach to the DPA. Describes measures **actually implemented**; do not promise more.

## 1. Hosting and data residency

- Application and database: **United States** (region to be confirmed); EU option on request.
- Documents: encrypted object storage, signed-URL access, **24-hour TTL**.
- The application server does not retain documents; it keeps only job metadata.
- Hosting: [Render/AWS] — **SOC 2 Type 2** report and DPA available under NDA.
- CDN/WAF: Cloudflare; payments: Stripe; transactional email: [provider].

## 2. Encryption

- **In transit:** TLS 1.2+ (HSTS).
- **At rest:** AES-256 (object storage and database); provider-managed keys with rotation.
- **Secrets:** secret manager / encrypted environment variables; never in code.

## 3. Access and isolation

- **RBAC:** admin, operator, viewer; least privilege.
- **MFA** for admin accounts; SSO on request.
- **Tenant isolation:** each firm sees only its own jobs/documents; isolation tests.
- **Support access:** no access to content; screen sharing or content-free logs only.
- Quarterly access review; immediate offboarding.

## 4. Logging

- Logs: events (upload, job, download, deletion), job IDs, error codes.
- **No text, file names, PII, or content** in logs.
- Log retention: 30 days; restricted access.
- Exportable audit trail for the Client.

## 5. Retention and deletion

- Documents: **maximum 24 hours** after job completion (or immediately on request).
- Outputs: download then deletion under the same policy.
- **Deletion certificate:** job hash, date, file count; no PII.
- Backups: encrypted, **7 days**, restore tested; deleted after the window.

## 6. Development and vulnerabilities

- Code review before deployment; pinned dependencies; vulnerability scanning.
- Critical fixes within **7 days**; high within **30 days**.
- **Pen test** before the first cloud client, then annually; attestation letter under NDA.
- SBOM and image hashes; signed deployments.

## 7. Incident response

- Incident runbook; named owner; timestamped record.
- Client notification without undue delay, **72 hours** where the GDPR applies.
- Content-free post-mortem; tracked corrective actions.

## 8. AI and data

- **No training** on Client documents.
- **No external LLM call** for Client documents; models run inside the service environment.
- If an external model is added: written Client consent + DPA + training opt-out.
- Reports contain **no content**, only counters, types, and identifiers.

## 9. Personnel and subprocessors

- Signed confidentiality; annual security training.
- Subprocessors listed; DPA; SOC 2 or equivalent report; prior notice before addition.

## 10. Limits to disclose

- OCR quality varies with image quality; degraded scans may need human review.
- The service is **document QC**, not legal advice.
- Deletion is proven by certificate; it cannot prove the Client did not keep its own copies.