# 06 System description (draft of report Section III)

This is the draft of the description the auditor examines against the AICPA Description Criteria (DC 200). It is written by management, not by the auditor, and every statement in it is tested. Placeholders in square brackets are filled after the hosting decision in [01](/soc2/01-scope). Do not fill a placeholder with a plan. Fill it with what is running.

## 1. Company overview and services provided

Rang & Mall Private Limited is a private limited company incorporated in India, registered in Visakhapatnam, Andhra Pradesh. It builds and operates software products for businesses and individuals. This description covers the **RM Platform**: the shared infrastructure, identity service, and the business products listed below.

| Service | What customers use it for |
| --- | --- |
| Gate | Single sign-on and identity for every in-scope product |
| Mail | Business email |
| Drive | File storage and sharing |
| Meet | Video meetings |
| Writer | Document editing |
| Sign | Electronic signatures |
| Bills | Invoicing |
| RM Cloud | Managed hosting for client websites and applications |

## 2. Principal service commitments and system requirements

Commitments made to customers in the terms of service, data processing agreement, and security page include:

- Customer data is encrypted in transit (TLS 1.2 or higher) and at rest.
- Customer data is stored in India. [Confirm region after the hosting decision.]
- Access to customer data by Rang & Mall personnel is limited to what is needed to operate and support the service, and is logged.
- Rang & Mall notifies affected customers of a security incident affecting their data without undue delay, and within contractual timeframes.
- Customer data is deleted within [30] days of account closure, and from backups within [90] days.
- Availability target: [state only a target that is measured; no uptime figure is published until it is].

System requirements that follow from these commitments are expressed as the controls in the [control matrix](/soc2/02-controls) and the policies 10 to 25.

## 3. Components of the system

### Infrastructure

[Provider, region, compute, database, storage, network diagram. Production hosts run production only. Edge through Cloudflare. Administrative access path.]

### Software

- Application code for each in-scope product, in [GitHub organization].
- Postgres databases, one per product.
- Supporting services: [log platform], [uptime monitor], [secrets store], [ticketing].

### People

[Number of personnel, roles held from the owners table. Contractors, if any.]

### Procedures

The policies 10 to 25 and the controls in [02](/soc2/02-controls): access management, change management, operations and monitoring, incident response, backup and recovery, vendor management, risk management.

### Data

Customer account data (names, email addresses), customer content (email, files, documents, recordings, signatures, invoices), and system logs. Data is classified P0, P1 or P2 per the [compliance baseline](/playbook/02-universal-baseline). Each product's data map lists its fields.

## 4. System incidents

[Any incident in the period that resulted in a failure to meet a service commitment, or "None". Do not omit a known incident.]

## 5. Criteria and related controls

Security, Availability and Confidentiality. Each applicable criterion and its controls are in the [control matrix](/soc2/02-controls).

## 6. Complementary subservice organization controls

Rang & Mall uses the subservice organizations listed in [01 Scope](/soc2/01-scope#carved-out-subservice-organizations) and relies on them for the controls below. Their own reports are reviewed yearly (VND-02).

| Subservice organization | Controls we expect it to operate |
| --- | --- |
| [Cloud provider] | Physical access to data centres, environmental protection, hardware disposal, hypervisor isolation |
| Cloudflare | Edge network availability, DDoS mitigation, TLS termination integrity |
| GitHub | Integrity and access control of hosted repositories |
| Resend | Delivery and confidentiality of outbound email in transit |
| Stripe, Razorpay | Protection of cardholder data; card data never enters RM systems |

## 7. Complementary user entity controls

See [01 Scope](/soc2/01-scope#complementary-user-entity-controls-what-customers-must-do).

## 8. Significant changes during the period

[List, or "None".]