Overview

DocupletionForms.com, operated by Centinel Trust, follows SOC 2 Trust Services Criteria covering Security, Availability, Confidentiality, and Processing Integrity. Administrative and developer access is restricted through VPN and multi-factor authentication to safeguard all system and client data.

Key Technical Controls

Policy Summaries

1) Information Security Policy

All systems enforce HTTPS/TLS encryption and VPN-restricted access. Imunify360 continuously monitors for anomalies. JetBackup 5 provides encrypted daily backups. Logs and alerts are reviewed monthly, and policies are reviewed annually by the Compliance Officer.

2) Access Control Policy

Least-privilege access is applied to all accounts. Administrative access requires VPN authentication and MFA. Access is reviewed quarterly, and inactive accounts are deprovisioned within 24 hours.

3) Data Retention & Disposal Policy

Customer data from DocupletionForms applications (hosted in cPanel) is retained for up to three (3) years unless required longer by law or contract. Backups rotate every 30 days and are securely deleted thereafter. No production data is stored on unmanaged devices.

4) Incident Response Policy

Alerts from Imunify360 or system logs are reviewed within 24 hours. Confirmed incidents are logged, remediated immediately, and affected clients are notified within 72 hours where applicable.

5) Vendor Risk Management Policy

All critical vendors publish security documentation and undergo annual reviews for posture and compliance alignment.

Operational Practices

Approved Vendors & Systems

• AWS – Infrastructure & S3 storage
• cPanel / WHM – Server & application management
• JetBackup 5 – Encrypted backups
• Imunify360 – Malware detection
• AIDE – File integrity monitoring
• Outline VPN – Secure admin access gateway
• Google Workspace – Identity management & MFA

Logs & Review Records

• Access Review Log – Internal (Google Drive)
• Incident Log – Internal (Google Drive)
• Policy Review Log – Internal (Google Drive)
• Backup Restore Test Notes – Internal (Google Drive)

Each record includes date, reviewer, and summary result for audit consistency.

Readiness & Disclosure

DocupletionForms.com, operated by Centinel Trust, maintains a SOC 2-aligned control set appropriate for small-team operations. As customer and institutional volume increases, Centinel Trust plans to engage Vanta and an independent auditor for SOC 2 Type I / II certification. Additional documentation is available under NDA upon request.