Compliance posture
Where Penv Cloud stands on 10 September 2026, with no certification held, what is in place instead, and what an evaluation can check itself.
This is the posture on 10 September 2026. It claims nothing that is not built, so read the date before you quote it.
What certification is held
None. SOC 2 is in progress and no report exists yet. If your procurement gate is the report itself, the honest answer is that penv does not have it.
An audit report is evidence that somebody independent checked. Until one exists, the six properties below are what an evaluation can stand on, and each is enforced by the database or the test suite rather than by anyone remembering.
Six things you can check yourself
| Control | How it is enforced today |
|---|---|
| Logical access | Row-level security is forced on tenant tables and bound per transaction, so a query with no workspace context returns zero rows. |
| Integrity of the record | Only select and insert policies exist on the audit table. Update and delete are denied to us as well as to you. |
| Key management | One data key per value version, wrapped by a key service, with the wrapping key id recorded on every version. |
| Boundary protection | Outbound requests are range-checked inside the socket's own DNS lookup and never follow a redirect. |
| Vendor management | The subprocessor register is public and names which one holds a plaintext value in memory. |
| Value handling | Values carry a type whose serializers print [redacted]. Revealing one is an explicit call. |
Two of these have a stronger property than a policy could give them. Private ranges, loopback,
link-local and carrier NAT are refused on every outbound request, which includes
169.254.169.254, the cloud metadata address that turns a request forgery into a credential. And a
3xx response is treated as data, so following one can never re-send an authenticated request to an
address nothing validated.
What is baked in from the first commit
- No value in a log, an error or a URL.
- Encryption at rest through an envelope and a key service, and TLS in transit.
- Least-privilege database and key grants.
- An append-only record of who did what.
These make later audit evidence a reporting exercise rather than a retrofit. They are not the evidence itself.
What is not built
Each row below is something a buyer asks for and penv does not have on this date. Read it now rather than in month three.
| Thing | Where it stands |
|---|---|
| Dedicated infrastructure | Shared. There is no private instance, no VPC option and no choice of region. |
| Private networks | penv reaches your services from the public internet, so a service only reachable inside your VPC is out of reach. |
| Chained record entries | The prev_hash column is reserved and nothing writes it. Every row holds null, and no hashing code exists. |
| An error reporter | None. SENTRY_DSN is a schema placeholder that nothing reads, so an exception is visible in the platform request log and nowhere else. |
| Operational log shipping | None. Failed-auth spikes and anomalous read volume are findable by reading logs by hand. |
Breach detection and future audit evidence rest on the audit log alone. That is why the log is the one thing enforced at the database rather than in application code.
How long the record is kept
| Plan | Kept for |
|---|---|
| Free | 7 days |
| Pro | 90 days |
| Enterprise | Set by your contract |
A daily job deletes rows past your plan's window through a database function scoped to one workspace and one oldest-first batch per call. It holds no delete permission of its own, so the table stays append-only for every application role. Where a workspace streams the log to its own destination, the job refuses to delete past what that destination has acknowledged.
What an Enterprise contract adds
Enterprise carries a security questionnaire answered by a person, a signed data agreement, and a 99.9% uptime promise. Encryption is not one of the differences. It is the same on every plan.
Legal values still to be filled in
The privacy policy and the terms of service read their values from one configuration file, and each unset value is highlighted on the published page until someone fills it in. On this date the governing law, the retention periods, the transfer mechanism and the hosting regions are among the unset ones. Ask before you rely on any of them.
Next: report a vulnerability.