ProSurvey Apps Limited (company no. 17118570) · Trust & Security Handbook
Audience: security reviewers, auditors and procurement teams completing a security questionnaire or RFP. Last evidence review: 15 July 2026. This page maps shipping controls and documented gaps; it does not claim a certification or independent assurance report that HousingSurvey Pro does not hold.
How to read this
- Implemented (✅): built and operating in the production service today.
- Partially implemented (🟡): useful control exists, but the stated gap means it is not yet complete across the intended scope.
- Planned (⬜): documented intent only; do not rely on it as a control.
The status is about HousingSurvey Pro's own control implementation, not certification. Framework references are the ICO's UK GDPR security guidance, ICO breach-reporting guidance, ISO/IEC 27001:2022 and the AICPA SOC 2 examination guidance. Control identifiers are a practical cross-reference, not an auditor's opinion.
Security governance & policies
| Control | Frameworks | Status | Current evidence and limits |
|---|
| Information security policy set (ISMS) | ISO A.5.1, SOC 2 CC1.1, CC5.3 | ✅ | A maintained internal ISMS policy set covers information security, access control, incident response, business continuity/DR, data retention and disposal, vendor management, and internal acceptable use. The founder is the accountable owner acting as interim CISO; each policy states the compensating controls used in a one-person company (append-only hash-chained audit, the nightly integrity verifier, and CI gates as an automated second reviewer). Drafted internally, not independently assured, and not a certification. |
| Access-review cadence | ISO A.5.18, SOC 2 CC6.2, CC6.3 | 🟡 | A quarterly access-review procedure with a concrete Firebase/Google Cloud checklist (superadmin claims, IAM, per-org membership, overrides, API/SCIM tokens, SSO) is defined. The first documented review cycle has not yet run. |
| Supplier / sub-processor management | ISO A.5.19–A.5.22, SOC 2 CC9.2 | ✅ | A vendor-management policy governs onboarding criteria and at-least-annual review over the maintained, published Subprocessor Register, with 30-day customer notice of changes. |
| Risk and gap tracking | ISO A.5.7, SOC 2 CC3.1–CC3.4 | ✅ | An internal gap register records each open item with a severity, owner and status; founder-only actions are mirrored to the internal action list. Available to procurement/auditors on request. |
Access control & identity
| Control | Frameworks | Status | Current evidence and limits |
|---|
| Role baselines and least privilege | ISO A.5.15, SOC 2 CC6.1, UK GDPR Art.32 | ✅ | Eight organisation roles supply backwards-compatible module baselines through a shared, parity-tested evaluator. Live member role/status and effective levels are enforced in callables, Firestore rules, Storage rules and the apps. See Access Control & Permissions. |
| Per-member module overrides | ISO A.5.15, SOC 2 CC6.1 | ✅ | Authorised module administrators can replace a non-owner member's baseline with sparse None/View/Edit/Module-admin levels. The audited callable is the only writer; changes are document-backed and immediate, malformed state fails closed, and the portal shows baseline, override, effective level and scope. |
| Tenant and record scope enforced server-side | SOC 2 CC6.1, ISO A.5.15 | ✅ | Active organisation membership, default-deny Firestore/Storage rules and emulator denial tests enforce the boundary independently of the UI. Storage image paths resolve their survey/work order and retain assignment checks; legacy paths that cannot prove assignment are closed to new writes. |
| Server-only privileged surfaces | SOC 2 CC6.1 | ✅ | Member/role/permission mutations, audit events, API keys, billing, private provider settings and evidence-sealing fields are client-unwritable and changed through authorised server logic. |
| MFA for privileged users | ISO A.5.17, SOC 2 CC6.1 | 🟡 | TOTP/passkey enrolment and manager+ application gates exist; platform-superadmin rules/callables require a current second-factor proof. Equivalent server-side step-up enforcement is not yet universal for ordinary manager/org-admin actions. |
| Remote session revocation | SOC 2 CC6.1, UK GDPR Art.32 | ✅ | Organisation admins can revoke a member's refresh tokens; users can sign out all of their own sessions. Both paths are audited. |
| SSO and automated provisioning | ISO A.5.16, SOC 2 CC6.1 | ✅ | Enterprise admins can configure Entra-compatible OIDC/SAML and mint a hashed SCIM bearer token; SCIM joiner/leaver operations enforce tenant scope and seat rules. See SSO setup. |
| Operative least-privilege baseline | ISO A.5.15, SOC 2 CC6.1 | ✅ | The inherited operative baseline is works-only. Record-bearing field modules remain limited to assigned records even when upgraded. An authorised administrator may explicitly grant an administrative/non-record module at organisation scope; the UI labels that as outside the role baseline and the server retains its normal module limits. |
Cryptography & data protection
| Control | Frameworks | Status | Current evidence and limits |
|---|
| Encryption in transit | ISO A.8.24, SOC 2 CC6.7, UK GDPR Art.32 | ✅ | Customer and integration endpoints use managed HTTPS/TLS. |
| Encryption at rest | ISO A.8.24, SOC 2 CC6.7, UK GDPR Art.32 | ✅ | Firestore and Cloud Storage use managed encryption at rest. |
| Password handling | UK GDPR Art.32, ISO A.8.24 | ✅ | Passwords are delegated to Identity Platform and are never stored or logged by application code. |
| Secret and key protection | SOC 2 CC6.1, ISO A.8.24 | ✅ | Platform secrets use managed server-side injection; tenant provider credentials are rules-denied private records; API/SCIM tokens are stored as hashes and displayed once. |
| Production app/client attestation | SOC 2 CC6.6 | ✅ | App Check is enforced on production Firestore, Storage, Identity Toolkit, OAuth, Maps and Places. Web/native clients use reCAPTCHA Enterprise, App Attest or Play Integrity. Nonprod is deliberately monitor-only so it must not be treated as enforcement evidence. |
| Branded authentication email | ISO A.5.16, SOC 2 CC6.1 | 🟡 | Branded templates and custom-domain configuration are present. The provider's admin API still reports the custom-domain verification state as incomplete, so custom-domain delivery is not claimed as fully proven. |
Integrity & evidential controls
| Control | Frameworks | Status | Current evidence and limits |
|---|
| Sealed, tamper-evident records | ISO A.8.15, SOC 2 CC7.2 | ✅ | Server-authoritative finalisation, canonical SHA-256 hashes and a per-property chain; client/API rules prevent mutation of sealed content. See Evidence Integrity. |
| Integrity verification and alerting | SOC 2 CC7.2, CC7.3 | ✅ | The scheduled verifier recomputes chains, records clean runs and raises quarantine metadata, audit events and organisation notifications on mismatches. |
| Change/version history retained | ISO A.8.15, UK GDPR Art.5(1)(f) | ✅ | A correction creates a new sealed version with lineage/version/supersedes fields; prior versions remain retrievable and are included in organisation export. |
| Audit-logged lifecycle transitions | ISO A.8.15, SOC 2 CC7.2, CC8.1 | ✅ | Work-order cancellation, proxy completion, external-summary marking, works attestation and case closure are server-authorised and append immutable, hash-chained audit events with actor/reason. |
| Incident response | ISO A.5.24–A.5.26, SOC 2 CC7.4 | 🟡 | A tested evidence-tamper runbook preserves original bytes and prioritises disclosure, and a general incident-response plan (severity model, response lifecycle, and the controller/processor breach duties) is now documented. The general-incident tabletop/exercise has not yet been run. |
Data subject rights & privacy
| Control | Frameworks | Status | Current evidence and limits |
|---|
| Lawful basis and data minimisation | UK GDPR Arts.5–6, 25 | ✅ | The service records property-condition evidence rather than resident profiles; purposes, roles and lawful bases are documented in Data Protection & GDPR and the Privacy Policy. |
| Access and portability export | UK GDPR Arts.15, 20 | ✅ | Organisation admins can download a signed ZIP covering all survey versions, work orders, properties, members, audit, billing and a photo manifest; export is audited. |
| Erasure/offboarding with authority and audit | UK GDPR Art.17 | ✅ | Self-service personal-data deletion and cancellable organisation deletion are server-authorised and audited; sealed legal-claims evidence is retained/redacted under the documented exception rather than silently destroyed. |
| Records of processing activities (RoPA) | UK GDPR Art.30 | ✅ | An Art.30 record covering both our processor activities (tenant/property evidence, work orders, customer staff accounts) and our controller activities (account, billing, consent-gated website/product analytics) is maintained internally and provided to controllers/auditors on request. It reflects the real data model, including the optional controller-supplied tenant-contact fields. Maintained internally; not independently assured. |
| Customer Data Processing Agreement | UK GDPR Art.28 | ✅ | The current DPA is published and covers processor duties, rights assistance, breach notification, deletion/return, subprocessors and technical measures. Legal review/countersignature may still be required for a customer's procurement process. |
| Personal-data breach notification support | UK GDPR Arts.33–34 | 🟡 | The DPA commits to notify controllers without undue delay and assist with Arts.33–34, and the incident-response plan documents the processor/controller notification duties and the ICO 72-hour threshold. The exercise needed to evidence repeatable 72-hour support is not yet complete. |
| Retention enforcement and configuration | UK GDPR Art.5(1)(e), ISO A.8.10 | 🟡 | Live scheduled janitors enforce configured draft/org deletion windows and a 90-day EDI artefact default while retaining audit/accounting records; the full retention schedule by data class is documented in a Data Retention & Disposal policy. A customer-admin per-organisation evidence-retention control is still planned. |
Operations, resilience & suppliers
| Control | Frameworks | Status | Current evidence and limits |
|---|
| Firestore PITR and scheduled backups | ISO A.8.13, SOC 2 A1.2 | ✅ | Production PITR is enabled with a seven-day version window plus daily backups retained for 98 days. Nonprod has only Firestore's one-hour baseline and no scheduled backup. |
| Firestore recovery testing | ISO A.5.30, SOC 2 A1.2 | 🟡 | A nonprod drill recovered changed/deleted documents by point-in-time reads into an isolated database. The production-equivalent PITR bulk export/import and scheduled-backup restore paths have not yet been exercised. |
| Cloud Storage recovery | ISO A.8.13, SOC 2 A1.2 | ✅ | Both evidence buckets have versioning, 14-day soft delete and 30-day noncurrent-version cleanup. Production mirrors nightly to a separate versioned Archive bucket in London; the scheduled 15 July run succeeded. The backup is same-region to preserve UK residency, so it protects bucket/object loss but not a whole-London-region outage. |
| Availability and error monitoring | SOC 2 A1.1, CC7.2 | 🟡 | Managed cloud metrics, chain alerts, web performance/error telemetry and native Crashlytics code exist. Native Crashlytics awaits the next store binary, backup-job failure alerting and a published SLO/alert policy remain open. |
| Change management and CI gates | SOC 2 CC8.1, ISO A.8.32 | ✅ | CI runs lint, coverage-gated tests, type/build checks, emulator rules tests and hash-twin parity; production deploys depend on CI and a protected environment. |
| Deployment-environment integrity | SOC 2 CC8.1, ISO A.8.32 | ✅ | Bundle identity assertions and Firebase hosting predeploy hooks block a prod/nonprod asset mix-up even when the raw deploy CLI is used. |
| Subprocessor register and residency disclosure | UK GDPR Art.28, ISO A.5.19 | ✅ | The maintained Subprocessor Register identifies purpose, entity and transfer/residency position. The primary Firestore/Functions/Storage data plane and evidence backup are London-hosted; disclosed ancillary subprocessors may involve international transfers under stated safeguards. |
| Vulnerability management | ISO A.8.8, SOC 2 CC7.1 | 🟡 | Automated dependency update workflows and CI checks exist; a formal vulnerability-management policy, remediation SLA and completed independent penetration test remain outstanding. |
Certification and assurance status
- UK GDPR: a legal compliance posture, not a certificate. The implemented controls and gaps above are the evidence; customers remain controllers for their own use of the service.
- SOC 2: no SOC 2 report has been obtained. A SOC 2 examination is an independent CPA assessment of control design/operation; this mapping is not a substitute.
- ISO/IEC 27001:2022: not certified. Control alignment does not equal an accredited certificate or a complete ISMS.
- Cyber Essentials: not certified. Technical alignment and roadmap work do not constitute an IASME assessment or certificate.
We will use “certified”, “attested” or “SOC 2 report” only when the relevant independent evidence exists and will make it available through the appropriate procurement channel.
Status: living control register. Evidence and gaps were checked against the shipping repository and live production/non-production configuration on 15 July 2026. A ✅ records a current control, not a promise that every adjacent governance process is complete.
