≪ View Page

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
pub:trust_center:controls [14.07.2026 09:45] – remove IRIS Predrag Tasevskipub:trust_center:controls [21.07.2026 14:00] (current) – Predrag Tasevski
Line 7: Line 7:
 This table provides a breakdown of how each MVSP requirement is met using Unicis-native tools or vetted third-party open-source components. This table provides a breakdown of how each MVSP requirement is met using Unicis-native tools or vetted third-party open-source components.
  
 +==== Business Controls ====
  
 ^ MVSP Area          ^ Control                         ^ Implementation                                                                                                                                  ^ ^ MVSP Area          ^ Control                         ^ Implementation                                                                                                                                  ^
Line 18: Line 19:
 | Business Controls  | Data handling                   | End-of-life handling logged in OpenProject. Data deletion procedures follow checklist in **Unicis Cybersecurity Controls**.                     | | Business Controls  | Data handling                   | End-of-life handling logged in OpenProject. Data deletion procedures follow checklist in **Unicis Cybersecurity Controls**.                     |
  
 +==== Application Design Controls ====
 +
 +^ MVSP Area          ^ Control                         ^ Implementation                                                                                                                                  ^
 | Application Design Controls  | Single Sign-On (SSO)               | SSO enforced across platform. Self-hosted clients can connect to external IdP.                             | | Application Design Controls  | Single Sign-On (SSO)               | SSO enforced across platform. Self-hosted clients can connect to external IdP.                             |
 | Application Design Controls  | Multi-Factor Authentication (MFA)  | MFA required for all critical systems using TOTP or YubiKey. Enforced at SSO level.                        | | Application Design Controls  | Multi-Factor Authentication (MFA)  | MFA required for all critical systems using TOTP or YubiKey. Enforced at SSO level.                        |
Line 28: Line 32:
 | Application Design Controls  | Encryption                         | AES-256 at rest, TLS 1.3 in transit. Secrets handled securely; API keys scoped and rotated.                | | Application Design Controls  | Encryption                         | AES-256 at rest, TLS 1.3 in transit. Secrets handled securely; API keys scoped and rotated.                |
  
 +==== Application Implementation Controls ====
 +
 +^ MVSP Area          ^ Control                         ^ Implementation                                                                                                                                  ^
 | Application Implementation Controls | List of data | Data types (PII, etc.) documented in EspoCRM. Models versioned in Git and listed in Nextcloud. | | Application Implementation Controls | List of data | Data types (PII, etc.) documented in EspoCRM. Models versioned in Git and listed in Nextcloud. |
 | Application Implementation Controls | Data flow diagrams | Maintained in diagrams.net, stored in Nextcloud, referenced in **Unicis Cybersecurity Controls**. | | Application Implementation Controls | Data flow diagrams | Maintained in diagrams.net, stored in Nextcloud, referenced in **Unicis Cybersecurity Controls**. |
Line 34: Line 41:
 | Application Implementation Controls | Build process | CI/CD pipelines enforce clean builds, no hardcoded secrets. Provenance signed and tracked. | | Application Implementation Controls | Build process | CI/CD pipelines enforce clean builds, no hardcoded secrets. Provenance signed and tracked. |
  
-| Operational Controls  | Physical access             | Data centers via Hetzner/Scaleway (ISO 27001). On-prem setups provided with compliance templates.                                   |+==== Operational Controls ==== 
 + 
 +^ MVSP Area          ^ Control                         ^ Implementation                                                                                                                                  ^ 
 +| Operational Controls  | Physical access             | Data centers via Scaleway (ISO 27001). On-prem setups provided with compliance templates.                                   |
 | Operational Controls  | Logical access              | RBAC + SSO + MFA enforced. Access reviews quarterly using **Unicis Cybersecurity Controls**. Inactive accounts deactivated by n8n.  | | Operational Controls  | Logical access              | RBAC + SSO + MFA enforced. Access reviews quarterly using **Unicis Cybersecurity Controls**. Inactive accounts deactivated by n8n.  |
 | Operational Controls  | Sub-processors              | Public DPA maintained. Sub-processors reviewed annually and stored in Nextcloud. Linked to **Unicis Cybersecurity Controls**.       | | Operational Controls  | Sub-processors              | Public DPA maintained. Sub-processors reviewed annually and stored in Nextcloud. Linked to **Unicis Cybersecurity Controls**.       |
 | Operational Controls  | Backup & Disaster Recovery  | Weekly encrypted backups, restore tests annually. Logged in OpenProject, tracked in audit module.                                   | | Operational Controls  | Backup & Disaster Recovery  | Weekly encrypted backups, restore tests annually. Logged in OpenProject, tracked in audit module.                                   |