Security & Compliance

Your data security is our foundation. SolarPro is building toward SOC 2 Type II and ISO 27001 certification, with enterprise-grade security practices already in place.

Compliance Roadmap

✓

SOC 2 Readiness

All Trust Services Criteria controls implemented. Tamper-evident audit logging, MFA enforcement, RBAC, and incident response procedures are in place. Preparing for Type I audit.

◐

ISO 27001 Prep

Information Security Management System (ISMS) framework established. 11 security policies, risk register, and asset inventory complete. 80% control overlap with SOC 2.

○

GDPR / CCPA

Data export and deletion APIs implemented. Consent tracking, data classification, and retention policies in place. Sub-processor register maintained.

Security Practices

Authentication & Access

✓JWT-based authentication with HS256 algorithm
✓MFA (TOTP) enforced for all admin and staff accounts
✓Role-based access control (5 roles, least privilege)
✓Timing-safe credential comparison
✓Session timeout enforcement (8hr admin, 24hr homeowner)

Data Protection

✓AES-256-GCM encryption for sensitive data at rest
✓TLS 1.2+ for all data in transit
✓bcrypt (cost 12) password hashing
✓Data classification (4-tier: Restricted → Public)
✓GDPR/CCPA data export and deletion APIs

Infrastructure Security

✓Rate limiting on 37+ endpoint categories
✓CSRF protection on all state-changing endpoints
✓HMAC webhook signature verification
✓Vercel-hosted with automatic security patches
✓Neon PostgreSQL with encrypted connections

Monitoring & Audit

✓Tamper-evident audit logging (hash-chained entries)
✓SHA-256 chain integrity verification
✓Sentry error monitoring and alerting
✓Automated vulnerability scanning
✓Incident response plan with 4-tier severity

Security Policies

POL-SEC-001

Information Security Policy

Top-level security governance

POL-SEC-002

Acceptable Use Policy

System and network use rules

POL-SEC-003

Access Control Policy

RBAC and provisioning

POL-SEC-004

Data Classification Policy

4-tier data handling

POL-SEC-005

Incident Response Plan

4-tier severity response

POL-SEC-006

Change Management Policy

Deployment controls

POL-SEC-007

Data Retention & Disposal

Retention schedules

POL-SEC-008

Vendor Risk Management

Sub-processor oversight

POL-SEC-009

Password & Authentication

MFA and session management

POL-SEC-010

Encryption Policy

Algorithm and key management

POL-SEC-011

Business Continuity & DR

RPO/RTO and recovery

Sub-Processors

SolarPro uses the following sub-processors to process customer data. We maintain a sub-processor register and notify customers of material changes.

Sub-Processor	Purpose	Location	Certifications
Vercel	Application hosting & CDN	US	SOC 2 Type II, ISO 27001
Neon	PostgreSQL database hosting	US/EU	SOC 2 Type II
Stripe	Payment processing	US	PCI DSS Level 1, SOC 1/2
Upstash	Redis rate limiting	US/EU	SOC 2 Type II
Sentry	Error monitoring	US/EU	SOC 2 Type II
Anthropic	AI processing	US	SOC 2 Type II
OpenAI	AI processing	US	SOC 2 Type II
Resend	Email delivery	US	SOC 2
Google Cloud	File storage (GCS)	US	ISO 27001, SOC 1/2/3

Last updated: July 2025. For the complete sub-processor register with DPA status and data classification exposure, contact ray@underthesun.solutions.

Security Inquiries

For security questions, vulnerability reports, or to request our security questionnaire response, contact our security team.

Contact Security Team

Looking for the full posture summary? Visit our Trust Center — SOC 2 / ISO 27001 progress, subprocessors, policies, and the SOC 2 report request form.