Security & Compliance Pack (Baseline)

Key Rotation SOP

• Rotate signing keys on fixed cadence (recommended 90 days).
• Publish new key in JWKS before key activation.
• Keep previous key active during overlap window.
• Audit all rotations in token/key audit logs.

Incident Runbook

• Severity model (SEV-1 through SEV-4).
• Token compromise response:
• revoke affected refresh tokens
• rotate signing keys if needed
• invalidate sessions and notify impacted orgs
• Post-incident report within 72 hours.

Enterprise Documentation Bundle

• Data processing addendum (DPA)
• Security architecture summary
• Subprocessor list
• Access control and audit policy

Audit Export Endpoints

• Consent audit exports
• OAuth token audit exports
• Admin action logs
• Signed compliance bundle exports
• Latest stored bundle retrieval

Automated Compliance Runs

• GitHub Actions workflow: .github/workflows/compliance-bundle-scheduler.yml
• Trigger endpoint: POST /api/compliance-bundles/run-scheduled
• Required GitHub Action secrets:
• LAST1_API_BASE_URL
• COMPLIANCE_SCHEDULER_TOKEN
• Required server env:
• COMPLIANCE_SCHEDULER_TOKEN (must match workflow secret)
• COMPLIANCE_BUNDLE_SIGNING_SECRET (recommended; falls back to IDENTITY_EXPORT_SIGNING_SECRET)

Week 2 Additions

• SOC2 control mapping
• penetration test summary template
• customer-facing trust center references