{
  "$comment": "Sentus.ai System Security Plan (SSP) — OSCAL 1.1.2",
  "$comment_2": "Hand-authored scaffold. Successor versions should be generated by scripts/soc2/generate-oscal-ssp.sh from docs/soc2/controls.yaml.",
  "system-security-plan": {
    "uuid": "4b3c7f2a-1f8e-4c2b-9b8f-7f9e2d0c5b9a",
    "metadata": {
      "title": "Sentus.ai System Security Plan",
      "published": "2026-04-20T00:00:00Z",
      "last-modified": "2026-04-20T00:00:00Z",
      "version": "0.1.0",
      "oscal-version": "1.1.2",
      "roles": [
        { "id": "system-owner", "title": "System Owner" },
        { "id": "engineering-lead", "title": "Engineering Lead" },
        { "id": "security-officer", "title": "Security Officer" }
      ],
      "parties": [
        {
          "uuid": "p-sentus-ceo",
          "type": "person",
          "name": "Jameson Adams",
          "email-addresses": ["jadams@sentus.ai"]
        },
        {
          "uuid": "p-sentus-org",
          "type": "organization",
          "name": "Sentus.ai"
        }
      ],
      "responsible-parties": [
        { "role-id": "system-owner", "party-uuids": ["p-sentus-ceo"] },
        { "role-id": "engineering-lead", "party-uuids": ["p-sentus-ceo"] },
        { "role-id": "security-officer", "party-uuids": ["p-sentus-ceo"] }
      ]
    },
    "import-profile": {
      "href": "#soc2-trust-services-criteria"
    },
    "system-characteristics": {
      "system-ids": [{ "id": "sentus-ai-production", "identifier-type": "https://sentus.ai/system-id" }],
      "system-name": "Sentus.ai — AI-Native Property Management Platform",
      "description": "Enterprise-grade, AI-native property management platform on Cloudflare (Workers, D1, KV, R2). Includes Sophia voice AI (ElevenLabs), 6 persona portals, multi-vertical (multifamily, CRE, HOA, STR, MHP, self-storage), and internal AI toolchain.",
      "security-sensitivity-level": "moderate",
      "security-impact-level": {
        "security-objective-confidentiality": "fips-199-high",
        "security-objective-integrity": "fips-199-high",
        "security-objective-availability": "fips-199-moderate"
      },
      "status": { "state": "under-development" },
      "authorization-boundary": {
        "description": "Covers Cloudflare Pages (app.sentus.ai + sentus.ai), all Cloudflare Workers, D1 databases, KV, R2, Queues, Durable Objects, GitHub Enterprise repository, Doppler secrets management, and sub-processors listed in docs/soc2/procedures/vendor-risk.md."
      }
    },
    "control-implementation": {
      "description": "Controls as implemented. Full evidence mapping lives in docs/soc2/controls.yaml.",
      "implemented-requirements": [
        {
          "uuid": "ir-cc6-1",
          "control-id": "cc6.1",
          "statements": [{ "statement-id": "cc6.1_stmt", "uuid": "ir-cc6-1-stmt", "by-components": [{ "component-uuid": "c-cloudflare-workers", "uuid": "ir-cc6-1-bc", "description": "Root JWT auth middleware on every v2 API route. IDOR, admin-escalation, and SQL-injection CI gates run on every PR." }] }]
        },
        {
          "uuid": "ir-cc6-6",
          "control-id": "cc6.6",
          "statements": [{ "statement-id": "cc6.6_stmt", "uuid": "ir-cc6-6-stmt", "by-components": [{ "component-uuid": "c-sentus-pwa", "uuid": "ir-cc6-6-bc", "description": "HSTS preload, X-Frame-Options DENY, COOP same-origin, CORP same-site, Permissions-Policy via security-headers.ts on every response." }] }]
        },
        {
          "uuid": "ir-cc6-8",
          "control-id": "cc6.8",
          "statements": [{ "statement-id": "cc6.8_stmt", "uuid": "ir-cc6-8-stmt", "by-components": [{ "component-uuid": "c-cloudflare-workers", "uuid": "ir-cc6-8-bc", "description": "SLSA Build L3 + CycloneDX SBOM on every production push. GitHub OIDC signed. Branch protection requires PR + status checks + review." }] }]
        },
        {
          "uuid": "ir-cc7-1",
          "control-id": "cc7.1",
          "statements": [{ "statement-id": "cc7.1_stmt", "uuid": "ir-cc7-1-stmt", "by-components": [{ "component-uuid": "c-cloudflare-workers", "uuid": "ir-cc7-1-bc", "description": "sentus-cost-monitor CRON every 5 minutes. 2x WARN / 5x CRITICAL / 10x EMERGENCY thresholds. AI_ENABLED kill-switch." }] }]
        },
        {
          "uuid": "ir-cc7-3",
          "control-id": "cc7.3",
          "statements": [{ "statement-id": "cc7.3_stmt", "uuid": "ir-cc7-3-stmt", "by-components": [{ "component-uuid": "c-sentus-pwa", "uuid": "ir-cc7-3-bc", "description": "NIST 800-61r2 incident response runbook. 4 SEV tiers, 6 phases, per-incident containment playbooks, quarterly tabletop cadence." }] }]
        },
        {
          "uuid": "ir-cc2-1",
          "control-id": "cc2.1",
          "statements": [{ "statement-id": "cc2.1_stmt", "uuid": "ir-cc2-1-stmt", "by-components": [{ "component-uuid": "c-d1-databases", "uuid": "ir-cc2-1-bc", "description": "pm-operations-db.unified_activities canonical audit table. sophia_conversations for voice interactions. Retention framework with append-only audit log." }] }]
        },
        {
          "uuid": "ir-cc6-2",
          "control-id": "cc6.2",
          "statements": [{ "statement-id": "cc6.2_stmt", "uuid": "ir-cc6-2-stmt", "by-components": [{ "component-uuid": "c-sentus-pwa", "uuid": "ir-cc6-2-bc", "description": "Quarterly access-review procedure. Covers 6 scopes: customer admins, Sentus staff, GitHub, Cloudflare, Doppler, Stripe. CEO attestation required." }] }]
        },
        {
          "uuid": "ir-a1-2",
          "control-id": "a1.2",
          "statements": [{ "statement-id": "a1.2_stmt", "uuid": "ir-a1-2-stmt", "by-components": [{ "component-uuid": "c-d1-databases", "uuid": "ir-a1-2-bc", "description": "D1 30-day PITR + 2x-daily backup workflow. Quarterly restore-drill procedure. RTO 4h, RPO 5 min." }] }]
        },
        {
          "uuid": "ir-p4-2",
          "control-id": "p4.2",
          "statements": [{ "statement-id": "p4.2_stmt", "uuid": "ir-p4-2-stmt", "by-components": [{ "component-uuid": "c-cloudflare-workers", "uuid": "ir-p4-2-bc", "description": "Retention framework: R2-first, 9 seeded policies (7yr ops / 2yr voice / permanent audit). Archiver CRON ships DRY_RUN=true; CEO enables writes after dry-run observation." }] }]
        },
        {
          "uuid": "ir-pi1-1",
          "control-id": "pi1.1",
          "statements": [{ "statement-id": "pi1.1_stmt", "uuid": "ir-pi1-1-stmt", "by-components": [{ "component-uuid": "c-sentus-pwa", "uuid": "ir-pi1-1-bc", "description": "Zod v4 input validation at the channel boundary via parseBody(). Shared schemas use .strict() to reject unknown fields." }] }]
        },
        {
          "uuid": "ir-cc6-3",
          "control-id": "cc6.3",
          "statements": [{ "statement-id": "cc6.3_stmt", "uuid": "ir-cc6-3-stmt", "by-components": [{ "component-uuid": "c-cloudflare-workers", "uuid": "ir-cc6-3-bc", "description": "CI gate blocks PRs mutating access-control tables without writing to unified_activities in the same handler." }] }]
        }
      ]
    },
    "back-matter": {
      "resources": [
        {
          "uuid": "r-controls-yaml",
          "title": "Sentus Controls Registry",
          "description": "Machine-readable source of truth for all SOC 2 controls, their status, evidence locations, automated checks, and owners.",
          "rlinks": [{ "href": "https://github.com/Sentus-Ai/Sentus/blob/production/docs/soc2/controls.yaml" }]
        },
        {
          "uuid": "r-trust-center",
          "title": "Public Trust Center",
          "rlinks": [{ "href": "https://sentus.ai/trust" }]
        }
      ]
    }
  }
}