System description (draft of report Section III)

This is the draft of the description the auditor examines against the AICPA Description Criteria (DC 200). It is written by management, not by the auditor, and every statement in it is tested. Placeholders in square brackets are filled after the hosting decision in 01. Do not fill a placeholder with a plan. Fill it with what is running.

1. Company overview and services provided#

Rang & Mall Private Limited is a private limited company incorporated in India, registered in Visakhapatnam, Andhra Pradesh. It builds and operates software products for businesses and individuals. This description covers the RM Platform: the shared infrastructure, identity service, and the business products listed below.

2. Principal service commitments and system requirements#

Commitments made to customers in the terms of service, data processing agreement, and security page include:

• Customer data is encrypted in transit (TLS 1.2 or higher) and at rest.
• Customer data is stored in India. [Confirm region after the hosting decision.]
• Access to customer data by Rang & Mall personnel is limited to what is needed to operate and support the service, and is logged.
• Rang & Mall notifies affected customers of a security incident affecting their data without undue delay, and within contractual timeframes.
• Customer data is deleted within [30] days of account closure, and from backups within [90] days.
• Availability target: [state only a target that is measured; no uptime figure is published until it is].

System requirements that follow from these commitments are expressed as the controls in the control matrix and the policies 10 to 25.

3. Components of the system#

Infrastructure#

[Provider, region, compute, database, storage, network diagram. Production hosts run production only. Edge through Cloudflare. Administrative access path.]

Software#

• Application code for each in-scope product, in [GitHub organization].
• Postgres databases, one per product.
• Supporting services: [log platform], [uptime monitor], [secrets store], [ticketing].

People#

[Number of personnel, roles held from the owners table. Contractors, if any.]

Procedures#

The policies 10 to 25 and the controls in 02: access management, change management, operations and monitoring, incident response, backup and recovery, vendor management, risk management.

Data#

Customer account data (names, email addresses), customer content (email, files, documents, recordings, signatures, invoices), and system logs. Data is classified P0, P1 or P2 per the compliance baseline. Each product's data map lists its fields.

4. System incidents#

[Any incident in the period that resulted in a failure to meet a service commitment, or "None". Do not omit a known incident.]

5. Criteria and related controls#

Security, Availability and Confidentiality. Each applicable criterion and its controls are in the control matrix.

6. Complementary subservice organization controls#

Rang & Mall uses the subservice organizations listed in 01 Scope and relies on them for the controls below. Their own reports are reviewed yearly VND-02.

7. Complementary user entity controls#

See 01 Scope.

8. Significant changes during the period#

[List, or "None".]