Compliance & Security Standards

1. Security Certifications & Frameworks

1.1 SOC 2 Type II Readiness

CEF Core is designed and operated in alignment with SOC 2 Type II standards for security, availability, processing integrity, confidentiality, and privacy. We implement comprehensive controls across:

• Security: Access controls, encryption, network security, and vulnerability management
• Availability: System monitoring, capacity planning, and incident response
• Processing Integrity: Data validation, error handling, and audit trails
• Confidentiality: Data classification and protection measures
• Privacy: Privacy controls aligned with GDPR and CCPA requirements

CEF Core has not yet undergone a formal SOC 2 Type II examination. Our infrastructure and controls are designed to align with AICPA Trust Service Criteria and are available for audit review by qualified firms.

1.2 Security Standards Compliance

• Encryption: TLS 1.2+ for data in transit. Encryption at rest is on the 2026 roadmap.
• Authentication: Multi-factor authentication (MFA) is available; we recommend it for privileged roles.
• Access Control: Role-based access control (RBAC) with principle of least privilege; tenant isolation enforced at the database via Row-Level Security.
• Audit Logging: Append-only audit log with cryptographic chaining for all financial transactions.
• Vulnerability Management: Internal security reviews; third-party penetration testing on the 2026 roadmap.
• Incident Response: Defined response procedures; on-call rotation maturing through 2026.

2. Data Privacy Compliance

2.1 GDPR Compliance (EU General Data Protection Regulation)

For customers and users in the European Economic Area (EEA), we comply with GDPR requirements:

• Lawful Basis: Clear legal basis for all data processing activities
• Data Subject Rights: Access, rectification, erasure, portability, and objection rights
• Data Protection Officer: Designated DPO available at dpo@cefcore.com
• Breach Notification: 72-hour breach notification procedures
• Privacy by Design: Privacy-first architecture and development practices
• Data Processing Agreements: GDPR-compliant DPAs available for all customers
• International Transfers: Standard Contractual Clauses (SCCs) for data transfers

2.2 CCPA Compliance (California Consumer Privacy Act)

For California residents, we honor CCPA rights:

• Right to Know: Disclosure of personal information collected and used
• Right to Delete: Request deletion of personal information (subject to legal exceptions)
• Right to Opt-Out: We do not sell personal information
• Non-Discrimination: No discrimination for exercising privacy rights
• Service Provider Status: Act as a service provider for customer organizations

2.3 Other Privacy Laws

We monitor and comply with evolving privacy regulations including:

• Virginia Consumer Data Protection Act (VCDPA)
• Colorado Privacy Act (CPA)
• Connecticut Data Privacy Act (CTDPA)
• Utah Consumer Privacy Act (UCPA)
• Other applicable state and federal privacy laws

3. Financial & Regulatory Compliance

3.1 Financial Services Regulations

While CEF Core is a software platform and not a financial institution, we design our Service to support customers' compliance with applicable financial regulations:

• Anti-Money Laundering (AML): Support for transaction monitoring and reporting
• Know Your Customer (KYC): Customer identity verification capabilities
• Securities Regulations: Tools for managing investment note offerings (customers are responsible for compliance)
• IRS Compliance: 1099 reporting support and tax document generation
• State Banking Regulations: Awareness of state-level requirements for church extension funds

Note: Customers are responsible for their own regulatory compliance. CEF Core provides tools to facilitate compliance but does not provide legal or regulatory advice.

3.2 Audit Support

We provide comprehensive audit support features:

• Audit Trails: Immutable audit trail for financial and administrative changes
• User Activity Logs: Complete history of user actions and system access
• Export Capabilities: Export data for external auditor review
• Retention Policies: 7-year data retention for financial records
• Audit Rights: Customer audit rights specified in service agreements
• Third-Party Audits: Infrastructure designed for independent SOC 2 examination

4. Infrastructure & Data Center Security

4.1 Cloud Infrastructure

CEF Core is hosted on dedicated cloud infrastructure in Ashburn, Virginia (US-East), with enterprise-grade security controls including:

• Dedicated compute resources with NVMe storage
• TLS 1.2 and 1.3 via automated Let's Encrypt certificates
• Reverse proxy with per-client request rate limiting
• Database reachable only from the application host, with role-based access
• Automated security patching and updates

4.2 Data Residency

Data storage and processing:

• Primary Region: United States (Hetzner, Ashburn, Virginia)
• Backup Location: Nightly backups are currently stored on the production host in the same region; off-site backup storage is planned
• Data Sovereignty: Customer data stored in accordance with data residency requirements
• Cross-Border Transfers: Documented and compliant with applicable laws

4.3 Disaster Recovery & Business Continuity

Our current recovery posture, stated plainly:

• Recovery Point Objective (RPO): Up to 24 hours today, set by the nightly backup schedule
• Recovery Time Objective (RTO): Target 4 hours (system restoration)
• Automated Backups: Nightly logical backups of every production database, each verified after it is written
• Geographic Redundancy: Not yet in place; off-site backup storage is planned
• Recovery Runbooks: Documented restore and recovery procedures for various failure scenarios

5. Application Security

5.1 Secure Development Lifecycle

• Code Reviews: Mandatory peer review for all code changes
• Static Analysis: Automated security scanning of source code
• Dependency Scanning: Continuous monitoring of third-party dependencies
• Security Testing: Internal security reviews; third-party penetration test planned
• Secure Coding Standards: OWASP Top 10 awareness and mitigation

5.2 Vulnerability Management

• Patching: Timely application of security patches and updates
• Vulnerability Disclosure: Responsible disclosure program for security researchers
• Bug Bounty: Consideration for bug bounty program implementation
• Security Advisories: Customer notification for security-relevant updates

6. Data Backup & Recovery

We implement multiple layers of data protection:

6.1 Backup Procedures

• Backup approach: Automated nightly logical backups of every production database, retained for 30 days. Continuous backup with restore to a chosen moment in time is planned but not yet available.
• Encryption: Backup files are stored on access-restricted infrastructure. Encrypting the backup files themselves is planned.
• Off-Site Storage: Not yet in place; backups are currently stored on the production host. Off-site storage in a separate location is planned.
• Integrity Verification: Each nightly backup is checked automatically after it is written, and a run in which any database fails is not published.

6.2 Recovery Capabilities

• Restore Point: Restore to the most recent nightly backup, or any nightly backup within the 30-day retention window
• Granular Recovery: Ability to restore an individual table or a full database
• Customer-Initiated Recovery: Self-service data export capabilities

7. Third-Party Security

7.1 Vendor Management

All third-party service providers are evaluated for security:

• Security Assessments: Review of vendor security certifications
• Data Processing Agreements: Contractual security requirements
• Access Controls: Minimum necessary access for vendor personnel
• Ongoing Monitoring: Regular review of vendor security posture

7.2 Sub-Processors

Current sub-processors include:

• Cloud Provider: Enterprise-grade cloud infrastructure and hosting
• Email Service Providers: None at present — outbound email from CEFCore is currently turned off

Complete sub-processor list available upon request. Customers will be notified of material changes to sub-processors with 30 days' notice.

8. Security Incident Response

8.1 Incident Detection

• Monitoring: System health dashboard with in-app alerts
• Brute-Force Protection: fail2ban on the server and account lockout after repeated failed sign-ins
• Log Review: Application and security logs retained for investigation

8.2 Incident Response Process

• Identification: Rapid incident identification and classification
• Containment: Immediate containment of security threats
• Investigation: Root cause analysis and impact assessment
• Remediation: Implementation of corrective measures
• Notification: Customer notification as required by law (72 hours for GDPR)
• Post-Incident Review: Lessons learned and process improvement

8.3 Customer Notification

In the event of a security incident affecting customer data, we will notify affected customers without undue delay, and no later than 72 hours after discovery, as required by applicable law.

9. Compliance Resources

9.1 Documentation & Reports

Available to customers upon request:

• SOC 2 Type II reports (when available)
• Penetration test summaries (once the planned third-party test is complete)
• Data Processing Agreement (DPA) templates
• Security questionnaire responses
• Sub-processor lists

9.2 Customer Audit Rights

Enterprise customers may have audit rights as specified in their service agreement. We accommodate reasonable audit requests with advance notice and appropriate confidentiality protections.

9.3 Security Training

All CEF Core employees receive regular security awareness training, including:

• Onboarding security training for new employees
• Annual refresher training for all personnel
• Specialized training for security and engineering teams
• Phishing awareness and simulation exercises

10. Continuous Improvement

We are committed to continuously improving our security and compliance posture:

• Regular Assessments: Quarterly security assessments and gap analysis
• Compliance Monitoring: Tracking of regulatory changes and new requirements
• Technology Updates: Adoption of emerging security technologies
• Industry Participation: Engagement with security and compliance communities
• Customer Feedback: Incorporation of customer security requirements

11. Contact & Reporting

11.1 Compliance Inquiries

11.2 Security Vulnerability Reporting