1. SOC 2 Type II Trust Services Criteria
LocalFilm Ireland maintains policies, operational procedures, and technical controls mapped directly to the American Institute of CPAs (AICPA) Trust Services Criteria:
Hardware-accelerated AES-256 volume encryption, TLS 1.3 in transit, automated web application firewall (WAF), and multi-layer intrusion mitigation.
99.9% uptime target with N+1 redundant cooling, dual-path power feeds, and diesel generator backups in our German datacenter node.
Parameterized SQL queries, atomic PostgreSQL transactions, and automated audit logging on all permission and roster dispatches.
Strict project role isolation, zero-AI model training guarantee, and cryptographically verified 2-step account erasure.
Direct regulation under DPC Ireland, Children First Act 2015 guardian roster gates, and full Chapter III data subject rights.
AICPA SOC 2 Type II Control Verification Matrix
| Control Domain | Criteria Ref | Technical Measure & Control Activity | Status |
|---|---|---|---|
| Access Governance | CC6.1 / CC6.2 |
Mandatory application-level ownership validation (req.user.id) on all mutations; role-based production access gates. |
VERIFIED |
| Cryptographic Storage | CC6.6 / CC6.7 |
Hardware AES-256-GCM volume encryption, TLS 1.3 in transit with HSTS preload, bcrypt (cost 12) salted credentials. | VERIFIED |
| Operational Integrity | CC7.1 / CC7.2 |
Automated Docker container health checks, structured audit trails on call sheet and roster mutations. | VERIFIED |
| Disaster Recovery | A1.2 / A1.3 |
Daily automated encrypted PostgreSQL dumps at 03:00 UTC, WAL point-in-time recovery, German ISO 27001 datacenter. | VERIFIED |
| Data Confidentiality | C1.1 / C1.2 |
Zero-AI model training guarantee on all uploaded screenplays and cast reels; cryptographically verified 2-step account erasure. | VERIFIED |
| Minor Safeguards & Privacy | P1.1 / P4.2 |
Children First Act 2015 guardian chaperone gates; direct regulation under Data Protection Commission of Ireland. | VERIFIED |
2. Cryptography & Key Management
All production data, user profiles, and call sheets are protected using industry-standard cryptographic algorithms:
| Scope | Standard | Implementation Details |
|---|---|---|
| Data in Transit | TLS 1.3 / TLS 1.2 |
Enforced via HSTS with preload. Modern cipher suites only (ECDHE-RSA-AES128-GCM-SHA256 / AES256-GCM-SHA384). |
| Data at Rest | AES-256-GCM |
Hardware-accelerated Linux kernel volume encryption on physical SSD arrays in German nodes. |
| Password Storage | bcrypt (cost 12) |
Slow one-way salted hashing. Plaintext passwords are never logged, printed, or accessible to administrators. |
| Session Tokens | JWT (HMAC-SHA256) |
Cryptographically signed JSON Web Tokens with 7-day expiration and automatic rotation. |
| Live Video Streams | DTLS-SRTP |
Direct end-to-end transport encryption via LiveKit SFU media relay. |
3. German Datacenter Security & EU Residency
LocalFilm Ireland maintains its primary cloud infrastructure with Hetzner Cloud GmbH in Germany (Falkenstein & Nuremberg datacenter parks). This ensures 100% European Union data residency governed by the General Data Protection Regulation and the German Federal Data Protection Act (BDSG).
- Physical Datacenter Certification: Certified according to DIN EN ISO/IEC 27001 standards.
- Biometric Perimeter Security: High-security perimeter fencing, 24/7 video surveillance, biometric access gates, and strict access logging.
- Power Redundancy: N+1 redundant uninterruptible power supply (UPS) systems backed by diesel generators.
- DDoS Mitigation: Automated multi-gigabit perimeter DDoS scrubbing filtering volumetric network attacks.
4. Application-Level Security & Access Controls
Our software development lifecycle enforces rigorous Application-Level Security checks across every API route and database mutation:
- Mandatory Ownership Verification: Backend controllers explicitly verify that
req.user.idextracted from the verified JWT matches the database record owner before executing anyINSERT,UPDATE, orDELETEoperation, completely preventing Insecure Direct Object References (IDOR). - SQL Injection Elimination: All PostgreSQL database operations utilize parameterized queries and structured ORM models.
- Rate Limiting & Anti-Brute-Force: IP-based and user-based request throttles on authentication and dispatch endpoints.
- Cross-Site Scripting (XSS) Defense: Strict Content Security Policy (CSP) headers, input sanitization, and automated output escaping across all UI templates.
5. Backup, Redundancy & Disaster Recovery
To protect film productions against unforeseen hardware disruptions or data corruption:
- Automated Daily PostgreSQL Backups: Full database dumps executed daily at 03:00 UTC and stored in encrypted backup vaults.
- Point-in-Time Recovery: Write-Ahead Logging (WAL) enables precise point-in-time recovery during catastrophic events.
- Containerized Isolation: Modular Docker container isolation with autoheal health-check monitors.
- Offline Set Mode: Local client caching (localStorage) ensures active call sheets remain readable on set even during complete cellular network blackouts.
6. Vulnerability Disclosure & Incident SLA
LocalFilm Ireland welcomes security researchers and community feedback through our Coordinated Vulnerability Disclosure Policy:
Security Contact: Please direct responsible vulnerability disclosures to [email protected]. We acknowledge all legitimate reports within 24 business hours and prioritize rapid remediation without penalizing good-faith research.
In the unlikely event of a confirmed personal data breach, LocalFilm executes its statutory 72-Hour Incident Protocol under GDPR Articles 33 & 34, notifying the Data Protection Commission (DPC) of Ireland and directly alerting affected users with remediation guidance.