Scope

A SOC 2 report describes one system: the infrastructure, software, people, procedures and data that deliver a named service. The narrower and cleaner the boundary, the cheaper and more credible the audit. This page is the scope decision. Change it only with the Security Owner's sign-off and a dated entry at the bottom.

Recommended scope for the first examination#

System name: RM Platform (the shared infrastructure, identity, and business-facing products of Rang & Mall).

Criteria: Security (mandatory) + Availability + Confidentiality.

• Availability is what business customers ask about first, and it forces the hosting decision below.
• Confidentiality covers customer data handling and disposal, which the playbook already requires.
• Processing Integrity is deferred: it fits RM Bills invoicing, but adds a full set of completeness and accuracy controls. Add it in year two if a customer asks.
• Privacy is deferred: the compliance playbook already handles DPDP, GDPR and US state law directly, and the Privacy criteria add audit cost without a buyer asking for them.

Report type: Type I first, then a Type II with a 3-month first observation window, then 12-month windows.

Products inside the boundary#

Pick products that business customers buy, and that run on infrastructure we can control end to end. Consumer products are not excluded because they matter less. They are excluded because nobody buys them with a security questionnaire.

The hosting rule (decides whether the audit is possible)#

In-scope production must run on infrastructure that can pass CC6.4 (physical access), A1.2 (environmental protection, backup, recovery infrastructure) and CC6.6 (boundary protection). Today every RM product, prototype and personal project shares one desktop machine on a consumer broadband line. An auditor will test physical access to that machine, power and network redundancy, and what else runs on it.

Two acceptable paths. Pick one before Phase 2 of the roadmap:

1. Move in-scope production to a cloud provider that holds its own SOC 2 Type II report (AWS ap-south-1, Google Cloud asia-south1, or Azure Central India, keeping data in India). The provider is a carved-out subservice organization: its report covers physical and environmental controls, and we test only our own. This is the normal path for a small company and the one this program recommends.
2. Keep self-hosting, in a colocation facility with its own SOC 2 or ISO 27001 report, dedicated hardware for production only, redundant power and network, and disk encryption. More work for us, still a carve-out of the facility.

Either way:

• Production hosts run production only. No game servers, personal projects, experiments, development servers, or AI coding sessions with interactive shells on the production host. Development happens on a separate machine.
• Production is reachable for administration only through a named, MFA-protected path (see 13 Access control).
• The current desktop machine can remain the development and staging environment.

Infrastructure inside the boundary#

Fill this in once the hosting decision is made. The system description draws from it.

Carved-out subservice organizations#

These vendors run controls we rely on and do not test ourselves. Their SOC 2 reports are collected yearly and reviewed for exceptions and for their complementary user entity controls (what they expect us to do). See 07 Vendor register.

• Cloud provider chosen above (physical, environmental, hypervisor, hardware disposal)
• Cloudflare (edge network, DDoS, TLS termination)
• GitHub (source hosting, access to code)
• Resend (outbound email delivery)
• Stripe and Razorpay (payment processing; card data never enters our systems)

Complementary user entity controls (what customers must do)#

The report lists these so a customer knows which controls are theirs. Draft list:

• Customers manage their own users' access in their workspace, and remove leavers promptly.
• Customers enable MFA for their users where the product offers it.
• Customers keep their own credentials and API keys confidential.
• Customers report suspected misuse of their accounts to security@ (see 20 Incident response).
• Customers decide what data they upload and are responsible for having the right to upload it.
• Customers who bring their own AI provider key are responsible for that provider relationship.

Scope entry criteria for a new product#

An app may be added to the scope for the next examination only when all of these are true:

1. It runs on in-scope production infrastructure only, deployed by the standard pipeline.
2. It authenticates staff and customers through Gate.
3. It has an app register entry in 04 and a data map.
4. Its repository is in the in-scope source organization with branch protection on.
5. It has had at least one quarter of operating the SOC 2 gate on every change.
6. Its backups are in the backup inventory and a restore has been tested.

Scope change log#