SOC 2 controls mapping
Implementation evidence for reviewing access, audit, change management, and tenant isolation.
Review the controls behind actions routed through Oxagen. This page maps implementation evidence to review topics. It is not a SOC 2 report from an auditor.
Access controls
Capability calls enter invoke(), which checks the declared surface, input, IAM, billing, entitlement, and decision rules before the handler. RBAC and roles describes the plan-dependent IAM resolver. Machine-purpose keys have an additional restriction before that resolver.
Use Organization → Roles to inspect permissions. Owners and Admins can manage custom roles. Use Organization → API keys to rotate or revoke workspace keys.
The auth package registers Better Auth's TOTP two-factor plugin. The app supports the /two-factor challenge. The app's viewer gate requires TOTP enrollment for Owners when the organization policy requires MFA and its grace period has expired. The API applies the same gate to a browser session and answers 403 with error.reason mfa_required. The gate does not apply to other roles or to API keys.
An Owner or Admin can register an OIDC or SAML 2.0 identity provider, map IdP groups to organization roles, and require SSO for members other than Owners. See Single sign-on. SCIM provisioning is not available yet, so removing someone from the IdP stops their next SSO sign-in but does not end an existing session or revoke their API keys.
Tenant isolation
Postgres policies and scoped Neo4j and ClickHouse clients enforce the supported data boundaries. Tenant isolation and RLS names the policy classes, enforcement flag, and integration evidence.
Security records
Postgres security.security_events holds security events. ClickHouse audit_events holds IAM decisions. The stores have different emitters and coverage. Writes are asynchronous, so failure to record does not fail the action.
The ClickHouse chain hash covers the predecessor hash, event ID, and capability. It does not cover every field, and concurrent writers can fork a chain. There is no built-in verifier. Audit logging documents these limits and the query API.
Change management
The repository records schema changes as versioned Atlas migrations. CI checks migration integrity and runs the required code checks before deployment. The repository's contribution rules require branches and pull requests for changes to main.
Third-party processing
Data handling describes the storage and inference boundaries. Review the actual provider configuration, external connections, and contractual terms for your deployment.
Review materials
Contact hello@oxagen.sh for currently available audit materials and contractual terms. An implementation mapping does not establish a Type II report, SLA, or certification.