ENTERPRISE READINESS
Enterprise readiness, without the gloss.
The security and operational controls a TPA should expect before trusting software with participant data, and where KinetiPlan stands on each one today.
CONTROL ROADMAP
Implemented versus planned, control by control.
| Control | Status | Detail |
|---|---|---|
| Role-based access control | Planned | Pilot build has no role permission model. Roles for administrator, analyst, reviewer, sponsor and participant are planned before any production use. |
| Multi-factor authentication | Planned | Planned through the customer’s identity provider (SSO with MFA). |
| Encryption in transit | To be verified | HTTPS/TLS is a requirement for every deployment; per-deployment evidence pending engineering verification. |
| Encryption at rest | To be verified | Database and file storage encryption with customer-managed keys is a design requirement; evidence pending. |
| Audit trails | Working in pilot build | Partly: exception resolutions are recorded with notes. A complete change log is planned. |
| Backup testing | Planned | Restore tests with recorded results per deployment. |
| Disaster recovery | Planned | Documented RPO/RTO and an annual DR exercise per deployment. |
| Vulnerability management | Planned | Dependency and container scanning in the build pipeline, patch timelines by severity. |
| Penetration testing | Planned | Independent test before the first production deployment; summary shared under NDA. |
| Secure development lifecycle | Planned | Code review, synthetic-data-only development, documented release process. Software Home staff sign NDAs, pass background checks and complete security training. |
| SOC 2 readiness assessment | Planned | Independent gap assessment against the Trust Services Criteria. No SOC 2 report exists today. |
Status key: Working in pilot buildOn this websiteScoped per customerPlannedEvaluating
"Working in pilot build" means the function runs in the KinetiPlan pilot build on synthetic demo data. It does not mean generally available, certified or production-proven. "To be verified" means the engineering team has not yet confirmed it with evidence.
SEQUENCE
What comes first
Before any pilot on de-identified data
- Customer-hosted environment
- TLS everywhere
- Approved, logged support access
- Synthetic-data development
Before production data
- Role-based access and SSO with MFA
- Encryption at rest evidenced
- Complete audit log
- Backup restore test
- Independent penetration test
Before a hosted offering
- SOC 2 readiness assessment
- DR exercise
- Vulnerability management evidence
- Then SOC 2 Type I, then Type II
NO OVERSTATEMENT
KinetiPlan is not SOC 2 certified and has no SOC 2 report, is not approved by the IRS or DOL, and is not a certified testing engine. Software Home follows SOC 2-aligned practices. This page is updated as controls are evidenced.