Stratify — Compliance Documentation Plan

v0.1 · 1 August 2026 · Owner: ISMS Owner (Toby)

1. The actual problem

Stratify has real, running production infrastructure (self-hosted on Hetzner since 2026-06-03), real personal data flowing through it, and a genuinely substantive privacy document already (docs/compliance/dsgvo-data-flow.md, owned by Antonios) — but no ISO 27001-shaped management system sits above the technical controls, and the existing compliance docs have drifted out of sync with the real infrastructure (Vercel → Hetzner, Resend → AWS SES, neither corrected yet). The gap isn't "get certified" — it's build the ISMS from the ground up, grounded in verified facts (see `register/facts.md`), so that:

• Every claim Stratify makes to a neobroker partner, an institutional investor, or eventually an

FMA regulator is traceable to a controlled document and a piece of evidence, in that order.

• The documentation set is itself credibility collateral for B2B partner onboarding — partners

integrating via REST/webhook/MCP will ask what's behind the audit-log claims.

• Certification (ISO 27001, if ever pursued) becomes a formality on top of an existing system,

not a scramble to retrofit one.

Two things worth being honest about upfront, straight from facts.md:

• Production is real and live, unlike a pre-launch product — this ISMS is retrofitting

controls around a running system with real subscriber and signal data, not writing ahead of go-live. Several controls score implemented (RLS, audit-log append-only enforcement, GDPR export/erasure) because they genuinely are, not aspirationally.

• Zero required human PR reviewers (single-committer repo) is a real, current

segregation-of-duties gap (Annex A 5.3) — document it as what it is.

2. Scope decisions

3. Architecture — one register, many outputs

docs/compliance/isms/
├── PLAN.md                   # this file
├── README.md                 # entry point / what's here
├── register/
│   ├── facts.md               # verified stratify ground truth — cite this, don't restate it
│   ├── schema.md               # front-matter + register field conventions
│   ├── controls.yaml           # Annex A 93 controls: applicability, justification, owner,
│   │                           #   status, evidence pointer, GDPR/revDSG crosswalk
│   ├── risks.yaml               # risk register — 9 real risks seeded from facts.md
│   ├── assets.yaml               # information assets — 13 real assets seeded from facts.md
│   └── suppliers.yaml             # sub-processors, DPA status, review dates — 12 seeded
├── governance/                # Tier 0 — ISO 27001 cl. 4-10 mandatory documents
├── policies/                  # Tier 1 — what we commit to
├── procedures/                # Tier 2 — how it actually gets done
├── privacy/                   # Tier 3 — GDPR + revDSG (cross-references dsgvo-data-flow.md)
├── evidence/                  # generated + collected, dated, immutable
└── tools/
    ├── build_controls.py      # Annex A list + crosswalk → controls.yaml
    ├── fill_controls.py       # Phase 0 gap-analysis judgments → controls.yaml
    ├── link_controls.py       # document front-matter → controls.yaml policy_doc/procedure_docs
    └── soa.py                 # controls.yaml → Statement of Applicability

Phase 0 complete as of this plan: facts.md, schema.md, all four register YAMLs, and the full build pipeline (all four scripts) exist and run cleanly — controls.yaml has all 93 controls judged (5 implemented, 39 partial, 35 not_started, 13 not_applicable, 1 planned), and `governance/GOV-06-statement-of-applicability.md` is generated from it.

4. Document set

Tier 0 — Governance (ISO 27001 cl. 4–10, mandatory)

Tier 1 — Policies (Annex A grouped into 12 domains)

Information Security · Acceptable Use & Asset Management · Access Control & IAM · Cryptography & Key Management · Supplier & Cloud Security · Secure Development · Operations & Change · Logging & Monitoring · Incident Management · Business Continuity & ICT Resilience · HR Security · Physical & Remote Working.

Tier 2 — Procedures

PRO-08 gets special attention. Stratify is exposed to two notification clocks today (GDPR Art. 33's 72h to the supervisory authority, and revDSG Art. 24's "as soon as possible", no fixed deadline) — and a third (DORA-equivalent 4h/24h clocks) becomes live once the FMA Liechtenstein licence lands per regulatory-roadmap-ch-eea.md. Write the decision tree for two clocks now, extend for the third at Phase C.

Tier 3 — Privacy (GDPR + revDSG)

Each of these is a thin ISO-formatted wrapper that cites `docs/compliance/dsgvo-data-flow.md` rather than re-deriving its content — see scope decision in §2. The wrapper adds the ISO front matter, the Annex A controls: linkage, and the one or two things the operational doc doesn't cover (the RoPA split, the Bearbeitungsreglement).

PRIV-03 is a hard legal obligation, not optional, same reasoning as on the sedAI ISMS: under VDSG Art. 5 a private controller must maintain a Bearbeitungsreglement where it carries out large-scale processing or high-risk profiling. Stratify processes financial-signal delivery data at scale (signal_deliveries, audit_log) — the determination needs to be made and documented either way; an assessed "not required" is defensible, silence is not.

5. Phasing

6. Open decisions — need answers before the phase they block

1. Stratify AG/GmbH incorporation timeline — blocks nothing in Phase 1-4 (controller-of-record

is confirmed as wait, what. Advisory for now) but should be re-verified before PRIV-01/GOV-01 are marked approved.

1. Buy ISO 27001 + 27002 texts (~CHF 380)? Recommend yes before Phase 2 (policy drafting) —

27002's control text drives Tier 1 wording directly. Same recommendation as the sedAI ISMS.

1. Who fixes the stale `dsgvo-data-flow.md`/`pentest-rfp.md` references (Vercel→Hetzner,

Resend→SES) — Toby (infra author) or Antonios (document owner)? Either works; just needs an owner before Phase 4 closes PRIV-01/02/08.

1. Second human reviewer timeline — no date established. RACI (GOV-03) needs to either name a

target or document why single-engineer is an accepted risk for now (RISK-002).