5 of 10 controls are in place, 4 partially, 1 not yet started. Firefly Reels is NOT SOC 2 certified — this is a readiness programme, and no control is counted as met until it is running in the product.
CC6.1
Logical access controls
SecurityIn placeEvery server action carries an ownership guard, audited by scripts/audit-actions.ts. Project and admin pages gate before any query rather than after render.
CC6.2
Credential lifecycle
SecurityIn placeProvider keys and OAuth tokens are encrypted at rest; API keys are hashed, scoped, spend-capped and revocable; plugin sessions revoke their key with the session.
CC6.6
Multi-factor authentication
SecurityIn placeTOTP and passkeys are available to all users, and 2FA is mandatory for admin accounts in production — enforced at the page level, not only in the layout.
CC7.2
Audit logging
SecurityIn placeAdminAuditLog is append-only: rows are never updated or deleted, including impersonation, credential rotation and credit adjustments.
CC7.3
Incident response
SecurityPartialStatus incidents are recorded and published, and provider outages fail over automatically. A written incident-response runbook with named on-call roles is not yet in place.
CC8.1
Change management
Processing integrityPartialA 29-stage verification suite plus adversarial bots gate every change, and pricing changes are versioned with effective dates. Formal change-approval records with separate reviewer sign-off are not yet kept.
CC9.2
Vendor management
SecurityPartialEvery model provider is registered with its licence posture and terms reviewed, and Cleared Content mode routes only to licensed-data engines. An annual vendor re-review cycle is not yet scheduled.
A1.2
Backup and recovery
AvailabilityNot startedDepends on the production database and object store, which are not yet provisioned. Restore testing is scheduled with that work.
C1.1
Confidential data handling
ConfidentialityIn placeCustomer content is never used for training (see the pledge). Card data goes token-only to Stripe and never touches these servers.
P4.2
Data retention and disposal
PrivacyPartialDownload-my-data and delete-account flows exist and work. The 30-day backup purge window is documented but cannot be evidenced until backups exist.