Appearance
Compliance Automation Integration
Tracks the state of the compliance-automation platform that ingests evidence against our SOC 2, HIPAA, and EDE control mappings — what's connected, what's automated, what's manual, what's open.
Vendor decision: deferred to procurement post-funding (target July 2026). Candidate vendors are Drata and Vanta. See compliance-automation-vendor-evaluation.md for the side-by-side decision criteria. Both vendors implement the same assume-role pattern with SecurityAudit + ReadOnlyAccess against AWS, so the choice of vendor does not change the connector list below — only the trust-policy ExternalId and the dashboard the evidence lands in.
Connection status
No vendor connected today. Planned timing: after (a) all vendor BAAs collected (Mongo BAA is the key open item, Asad-owned, see vendor-register.md), (b) end-to-end platform v1 lands ~2026-06-15, and (c) funding closes ~July 2026. Connecting earlier surfaces "control not evidenced" findings against infrastructure that hasn't been built yet, which is noise.
Pre-positioned AWS resources: DrataAutopilotRole IAM role exists in all four AWS accounts (mgmt 778477254880, prod 039624954211, staging 549136075525, log-archive 754660694122) with SecurityAudit + ReadOnlyAccess AWS managed policies + a DrataAutopilotExtras inline policy. Trust policy is a placeholder with ExternalId PLACEHOLDER-REPLACE-ON-DRATA-ONBOARD — never used. At vendor signing, the trust policy + ExternalId swap to the chosen vendor's official autopilot account ARN; if the selected vendor is Vanta, the role is renamed to ComplianceAutopilotRole (15-min Terraform change in infra/envs/{mgmt,prod,staging,log-archive}/ once those roles are imported into Terraform state in Phase 3b). See infra/envs/management/outputs-reference.md for the Phase 3b import list.
Expected connectors at signing
Priority order matches what the chosen vendor will need to auto-evidence the CC6/CC7 + §164 + EDE control rows already populated in the mapping files.
| Connector | What it evidences | Priority | Vendor coverage |
|---|---|---|---|
| AWS (all four org accounts) | Account inventory, IAM, VPC, encryption, CloudTrail, Security Hub findings | P0 — blocks most CC6/CC7 evidence | Both Drata + Vanta: first-class |
| MongoDB Atlas | Database users, roles, access lists, audit logs (both projects: askflorence-prod-01 + askflorence-staging) | P0 | Both: first-class |
| GitHub | Code review, branch protection, secret scanning, dependency scanning, member access | P0 | Both: first-class |
| Google Workspace | Employee roster, MFA enforcement, device compliance, Drive sharing posture | P0 | Both: first-class |
| HubSpot | Agent waitlist + survey audit trail (no PHI by design — see agent-platform/compliance.md) | P1 | Both: standard CRM connector |
| Linear / GitHub Projects | Ticket tracking, change-management evidence | P2 | Both: native integration |
Retired connectors (do not configure): Vercel (replaced by AWS ECS Phase 10, 2026-04-23); Resend (replaced by AWS SES 2026-04-30).
Automated vs manual register
Populated once a vendor is connected. Every control row from soc2-control-mapping.md, hipaa-control-mapping.md, and ede-control-mapping.md gets a row here indicating whether the platform can auto-evidence it or whether manual attestation is required.
Empty table today. Fill in at connection time:
| Control | Vendor connector | Automated? | Manual evidence owner |
|---|---|---|---|
| empty |
EDE Phase 3 is manual either way
Neither Drata nor Vanta pre-maps CMS EDE Phase 3 / MARS-E 2.2 controls. The vendor will auto-evidence the underlying NIST 800-53 R4 Moderate baseline + AWS FedRAMP Moderate inheritance, but EDE-specific narrative (Appendix A § 1–11) is hand-mapped in ede-control-mapping.md. Plan accordingly when budgeting vendor onboarding time — most of the SOC 2 + HIPAA mapping work absorbs automatically; the EDE mapping does not.
What "not yet connected" does NOT mean
It does not mean we skip building the evidence trail. Every control-relevant decision is captured in an ADR and linked from the SOC 2 / HIPAA / EDE mappings on the date it lands. When the vendor connects post-funding, most of that trail gets absorbed automatically; the parts that don't become manual-attestation rows here.
The operating habits (quarterly access reviews, incident postmortems, vendor-register updates) start happening as routine NOW — see ../infrastructure/access-reviews/ — so that July's evidence-window kickoff is a continuation of practice, not a new behavior.
