Security Compliance Roadmap

Overview

Close-Rate is committed to achieving industry-recognized security certifications as we scale. This document outlines our current security posture, the certifications we are working toward, and our timeline for achieving them. We believe in transparency about where we are today and where we are headed.

Current Security Posture

While we have not yet achieved formal SOC 2 or ISO 27001 certification, we have implemented substantive security controls that align with these frameworks:

SOC 2 Type II

SOC 2 Type II certifies that an organization's controls for security, availability, processing integrity, confidentiality, and privacy are operating effectively over a sustained period (typically 6-12 months).

Our SOC 2 Roadmap:

• Q1 2026 (Current): Document all existing security controls and policies. Perform internal gap analysis against SOC 2 Trust Service Criteria.

• Q2 2026: Engage SOC 2 readiness consultant. Implement identified control gaps (formal change management, access reviews, vendor risk assessments). Begin evidence collection.

• Q3 2026: SOC 2 Type I audit — point-in-time assessment of control design. Remediate any findings.

• Q4 2026: Begin SOC 2 Type II observation period (6 months). Continuous evidence collection and monitoring.

• Q2 2027: SOC 2 Type II audit completion and report issuance.

ISO 27001

ISO 27001 is an international standard for information security management systems (ISMS). It requires a comprehensive framework of policies, procedures, and controls.

We plan to pursue ISO 27001 certification after completing SOC 2 Type II, as many of the controls overlap. Our current policy documentation (Security Policy, Data Protection Policy, Incident Response Policy, Vulnerability Management Policy, Infrastructure Management Policy) forms the foundation of the ISMS documentation required for ISO 27001.

Near-Term Security Improvements

In addition to certification work, we are actively pursuing the following improvements:

• Implement automated SAST (Static Application Security Testing) in the CI/CD pipeline

• Move the rate-limit store to Redis/ElastiCache for a shared, durable app-wide ceiling (rate limiting is already enforced, but the store is currently per-worker in-memory)

• Complete the Create React App → Vite migration to eliminate build-time-only transitive dependency advisories from the frontend toolchain

• Add AWS WAF (Web Application Firewall) in front of the API

• Implement formal access review process for AWS IAM and database credentials

• Engage a third-party firm for an initial penetration test

• Implement structured audit logging for data access events

Questions

If you have questions about our security posture or compliance roadmap, please contact us at client-services@close-rate.com. We are happy to discuss our controls in detail with prospective and current customers.