{
  "schema_version": "1.0",
  "program_version": "2026-08-09",
  "last_reviewed": "2026-08-09",
  "operator": "Matheswaran Rajasekar, sole proprietor trading as AppCradle",
  "product": "AttuneMail",
  "scope": [
    "public website and React application",
    "Cloudflare Worker API and D1 data",
    "Workers AI email drafting",
    "Supabase authentication",
    "Amazon SES email delivery",
    "Dodo Payments hosted checkout boundary"
  ],
  "external_assurance": {
    "udyam": "registered Micro enterprise for classification year 2026-27; business registration only",
    "csa_star_cloud": "not submitted",
    "csa_star_ai": "not submitted",
    "cyber_essentials": "not certified",
    "soc_2": "not examined",
    "iso_27001": "not certified",
    "gdpr_certification": "not certified"
  },
  "current_controls": [
    {
      "control": "authenticated account-scoped workspaces",
      "status": "implemented and tested"
    },
    {
      "control": "DKIM, custom return-path SPF, and DMARC checks before campaign sending",
      "status": "implemented and tested"
    },
    {
      "control": "visible and one-click unsubscribe with suppression after opt-out, complaint, or permanent bounce",
      "status": "implemented and tested"
    },
    {
      "control": "website Content Security Policy and related response headers",
      "status": "configured in release; production verification required after deployment"
    },
    {
      "control": "RFC 9116 security.txt and public vulnerability reporting policy",
      "status": "configured in release; mailbox monitoring must be operator-verified"
    },
    {
      "control": "API secure-response headers and no-store caching policy",
      "status": "implemented and tested; production verification required after deployment"
    },
    {
      "control": "production dependency vulnerability audit",
      "status": "zero known production dependency vulnerabilities reported by npm audit on 2026-08-09; point-in-time result"
    },
    {
      "control": "hosted payment-card collection",
      "status": "Dodo Payments boundary; Dodo provider assurance does not certify AttuneMail"
    }
  ],
  "limitations": [
    "Framework use is not a certification.",
    "Configured controls require production verification after each material deployment.",
    "Customer legal compliance depends on recipients, permissions, content, instructions, and jurisdiction."
  ]
}