anonym.legal

Statement of Applicability (SoA)

Document ID: ISMS-POL-005
Version: 1.0
Effective Date: December 29, 2025
Review Date: December 29, 2026
Classification: Internal

1. Purpose#

This Statement of Applicability (SoA) documents the ISO/IEC 27001:2022 Annex A controls applicable to anonym.legal, their implementation status, and justification for inclusion or exclusion.

2. Scope#

This SoA covers all information security controls relevant to the anonym.legal PII anonymization platform, including:

  • Cloud-hosted infrastructure (Hetzner)
  • Web application (web framework frontend)
  • Backend services (Presidio Analyzer/Anonymizer)
  • Database (relational database)
  • Customer data processing

3. Control Selection Methodology#

Controls were selected based on:

  • Risk assessment results
  • Legal and regulatory requirements (GDPR)
  • Business requirements
  • Customer expectations
  • Industry best practices

4. Control Categories Overview#

CategoryTotal ControlsApplicableImplementedPartialNot Applicable
A.5 Organizational372520512
A.6 People86422
A.7 Physical145509
A.8 Technological34302824
Total936657927

5. Detailed Control Status#

A.5 Organizational Controls#

ControlTitleApplicableStatusJustification
A.5.1Policies for information security✅ImplementedInformation Security Policy documented
A.5.2Information security roles✅ImplementedRoles defined in RBAC system
A.5.3Segregation of duties✅ImplementedAdmin/Editor/User role separation
A.5.4Management responsibilities✅ImplementedDocumented in policies
A.5.5Contact with authorities✅PartialGDPR contacts identified
A.5.6Contact with special interest groups❌N/ASmall organization
A.5.7Threat intelligence✅Partialnpm audit, security advisories
A.5.8Information security in project management✅ImplementedSecurity in development process
A.5.9Inventory of information✅ImplementedAsset inventory documented
A.5.10Acceptable use of information✅ImplementedTerms of Service, policies
A.5.11Return of assets❌N/ASaaS model, no physical assets
A.5.12Classification of information✅ImplementedData classification defined
A.5.13Labelling of information❌N/AAutomated system handling
A.5.14Information transfer✅ImplementedTLS encryption, secure APIs
A.5.15Access control✅ImplementedRBAC, plan-based gating
A.5.16Identity management✅ImplementedNextAuth.js, JWT sessions
A.5.17Authentication information✅ImplementedPassword policy, 2FA
A.5.18Access rights✅ImplementedRole-based permissions
A.5.19Information security in supplier relationships✅PartialHetzner, Stripe reviewed
A.5.20Addressing security in supplier agreements✅PartialStandard agreements
A.5.21Managing information security in ICT supply chain✅ImplementedDependency management
A.5.22Monitoring, review of supplier services✅PartialUptime monitoring
A.5.23Information security for cloud services✅ImplementedHetzner security config
A.5.24Information security incident management✅ImplementedIncident Response Plan
A.5.25Assessment and decision on events✅ImplementedSeverity classification
A.5.26Response to information security incidents✅ImplementedResponse procedures
A.5.27Learning from incidents✅ImplementedPost-incident review
A.5.28Collection of evidence✅ImplementedLog retention, audit trails
A.5.29Information security during disruption✅ImplementedBackup/recovery procedures
A.5.30ICT readiness for business continuity✅ImplementedHetzner snapshots
A.5.31Legal, statutory, regulatory requirements✅ImplementedGDPR compliance
A.5.32Intellectual property rights✅ImplementedLicense compliance
A.5.33Protection of records✅ImplementedData retention policy
A.5.34Privacy and protection of PII✅ImplementedCore business function
A.5.35Independent review of information security❌N/ASmall organization
A.5.36Compliance with security policies✅ImplementedAutomated enforcement
A.5.37Documented operating procedures✅ImplementedDocumentation in docs/

A.6 People Controls#

ControlTitleApplicableStatusJustification
A.6.1Screening❌N/ASolo/small team
A.6.2Terms and conditions of employment❌N/ASolo/small team
A.6.3Information security awareness✅PartialSelf-awareness
A.6.4Disciplinary process❌N/ASolo/small team
A.6.5Responsibilities after termination✅ImplementedCredential revocation
A.6.6Confidentiality agreements✅ImplementedCustomer agreements
A.6.7Remote working✅ImplementedSecure remote access
A.6.8Information security event reporting✅ImplementedIncident reporting

A.7 Physical Controls#

ControlTitleApplicableStatusJustification
A.7.1Physical security perimeters✅ImplementedHetzner data centers
A.7.2Physical entry✅ImplementedHetzner controlled
A.7.3Securing offices, rooms, facilities❌N/ACloud-only
A.7.4Physical security monitoring✅ImplementedHetzner monitoring
A.7.5Protecting against physical threats✅ImplementedHetzner facilities
A.7.6Working in secure areas❌N/ACloud-only
A.7.7Clear desk and clear screen❌N/ARemote work
A.7.8Equipment siting and protection✅ImplementedHetzner data centers
A.7.9Security of assets off-premises❌N/ACloud-only
A.7.10Storage media❌N/ANo physical media
A.7.11Supporting utilities❌N/AHetzner managed
A.7.12Cabling security❌N/AHetzner managed
A.7.13Equipment maintenance❌N/AHetzner managed
A.7.14Secure disposal or re-use❌N/AHetzner managed

A.8 Technological Controls#

ControlTitleApplicableStatusJustification
A.8.1User endpoint devices❌N/ASaaS, no managed endpoints
A.8.2Privileged access rights✅ImplementedAdmin role, SSH keys
A.8.3Information access restriction✅ImplementedRBAC, feature gating
A.8.4Access to source code✅ImplementedPrivate repository
A.8.5Secure authentication✅ImplementedPassword policy, 2FA
A.8.6Capacity management✅ImplementedHetzner scalable
A.8.7Protection against malware✅ImplementedServer hardening
A.8.8Management of technical vulnerabilities✅Implementednpm audit, updates
A.8.9Configuration management✅ImplementedInfrastructure as code
A.8.10Information deletion✅ImplementedData deletion procedures
A.8.11Data masking✅ImplementedCore business function
A.8.12Data leakage prevention✅ImplementedEncryption, access control
A.8.13Information backup✅ImplementedHetzner snapshots
A.8.14Redundancy of information processing✅PartialSingle server (cost)
A.8.15Logging✅ImplementedApplication/system logs
A.8.16Monitoring activities✅ImplementedUptime, error tracking
A.8.17Clock synchronization✅ImplementedNTP configured
A.8.18Use of privileged utility programs✅ImplementedRestricted to admin
A.8.19Installation of software✅ImplementedControlled deployment
A.8.20Networks security✅ImplementedFirewall, brute force protection
A.8.21Security of network services✅ImplementedTLS, secure protocols
A.8.22Segregation of networks✅PartialApplication isolation
A.8.23Web filtering❌N/AServer-side only
A.8.24Use of cryptography✅ImplementedAES-256-GCM, TLS
A.8.25Secure development life cycle✅ImplementedCode review, testing
A.8.26Application security requirements✅ImplementedSecurity in design
A.8.27Secure system architecture✅ImplementedDefense in depth
A.8.28Secure coding✅ImplementedBest practices, linting
A.8.29Security testing in development✅ImplementedUnit testing, end-to-end testing, audit
A.8.30Outsourced development❌N/AIn-house development
A.8.31Separation of development, test, production✅PartialStaging environment
A.8.32Change management✅ImplementedVersion control, changelog
A.8.33Test information✅ImplementedMock data for tests
A.8.34Protection during audit testing✅ImplementedIsolated test environment

6. Exclusion Justifications#

Physical Controls (A.7.3, A.7.6, A.7.7, A.7.9-A.7.14)#

Justification: anonym.legal is a cloud-only SaaS platform hosted on Hetzner Cloud. Physical security is managed by Hetzner (ISO 27001 certified data centers). No physical premises or equipment are maintained.

People Controls (A.6.1, A.6.2, A.6.4)#

Justification: Small team/solo operation. Formal HR processes not applicable at current scale.

Endpoint Controls (A.8.1, A.8.23)#

Justification: SaaS model where customers use their own devices. No managed endpoints.

Outsourced Development (A.8.30)#

Justification: All development is performed in-house.

7. Implementation Evidence#

Control CategoryEvidence Location
Policiesdocs/iso27001/
Access Controllib/roles.ts, lib/plan-features.ts
Authenticationlib/auth.ts, lib/auth/two-factor.ts
Encryptionlib/encryption.ts
LoggingApplication logs, journalctl
Testingtests/ directory
Change Managementdocs/CHANGELOG.md
Configurationapp.config.js, web server configs

8. Continuous Improvement#

Planned Improvements#

ControlCurrent StatusTarget StatusTimeline
A.5.35N/AConsider external auditQ2 2026
A.8.14PartialFull redundancyQ3 2026
A.8.22PartialFull network segmentationQ2 2026

9. Document Control#

VersionDateAuthorChanges
1.02025-12-29Security TeamInitial release