System Description (SOC 2)

Purpose. The description of the system required for a SOC 2 examination — what the service is, its boundaries, the infrastructure and data that support it, and the control environment around it. The auditor reads this alongside the control matrix; it is the narrative the report is built on. Also serves ISO clause 4.3 (scope) and control CC2.3.

Status: DRAFT. Facts verified against the live AWS environment on 2026-08-08. Items still being remediated are stated plainly in §7 — a Type 1 description is expected to describe the system as it is, not as intended.

1. Company and service

Soon Technologies B.V. (KvK 75939401, Herengracht 420, 1017 BZ Amsterdam; incorporated 26-09-2019) provides Soon, a cloud-based Workforce Management (WFM) SaaS: employee scheduling, time & attendance, leave management, and AI-assisted forecasting and auto-scheduling.

Customers are organisations that use Soon to plan and manage their own workforce. Soon acts as a GDPR data processor for the personal data those customers put into the platform; the customer is the controller.

The company is privately held, founder-run and fully remote — four founders (Olaf Jacobson, Thomas Picauly, Melvin Jacobson, Alessandro Cardinali) plus one external security consultant. Soon operates no offices and no data centres.

2. Scope of this description

In scope — the core production platform:

Component	Description
soon-server	Core WFM backend API (production)
frontend	Customer-facing web application
solver / soon-intrasolver	Auto-scheduling and optimisation engines
soon-integrations, soon-connect	Integrations with third-party platforms
Supporting AWS infrastructure	Compute, database, storage, networking, monitoring (§4)

Out of scope: internal-only services (e.g. soon-seer), the devops tooling repository, and corporate IT beyond what supports the platform. Rationale recorded in Context & Scope (ISMS-DOC-04-1).

Trust Services Criteria: Security (Common Criteria CC1–CC9) only. Availability, Processing Integrity, Confidentiality and Privacy are not in scope for this examination.

Type: SOC 2 Type 1 — design and implementation of controls at a point in time.

3. The data Soon processes

Data	Examples	Classification
Customer workforce personal data	Employee names, emails, schedules, worked hours, leave, availability	Restricted
Customer account & configuration	Tenant settings, roles, permissions, integration config	Confidential
Authentication data	Credentials, tokens, session and SSO identifiers	Restricted
Billing data	Subscription and invoice records (card data is held by Stripe; Soon stores no PAN)	Restricted
Operational telemetry	Application and infrastructure logs, error traces (may incidentally contain personal data)	Confidential

Soon does not process special-category data by design. Full inventory: Information Asset Inventory.

4. Infrastructure

Verified in AWS account 742816139593, region eu-west-1 (Ireland), on 2026-08-08.

Layer	Implementation
Compute	AWS ECS/Fargate, Lambda; container images in ECR
Database	AWS RDS MySQL — rds-soon-soon-prod (production), rds-soon-soon-dev (development). Storage encrypted at rest (AES-256, KMS); automated daily snapshots, 7-day retention
Storage	AWS S3 — account-level Block Public Access enabled (2026-08-08)
Frontend delivery	Netlify / Cloudflare (CDN, TLS, WAF/edge protection)
Network	AWS VPC with security groups; TLS 1.2+ terminated at AWS-managed load balancers
Identity	WorkOS for enterprise SSO/SAML (Entra ID, Okta, Google Workspace); Google Workspace for internal identity
Monitoring & detection	AWS CloudWatch (metrics, alarms, logs), Sentry (application errors), AWS GuardDuty (threat detection over CloudTrail, DNS, VPC flow logs, S3 data events, RDS login events, EBS malware)
Audit logging	AWS CloudTrail
Source & CI/CD	GitHub (SoonHQ) — protected main, pull-request review, CI checks, Dependabot, code and secret scanning
IaC	OpenTofu/Terraform (migration in progress under Linear S-342)

Data residency: customer data is stored in the EU (AWS eu-west-1). One known exception — Intercom (customer support) currently runs on US infrastructure; migration to EU hosting is tracked as Linear S-303.

5. Sub-processors

Sub-processor	Purpose	Personal data
AWS	Cloud infrastructure (EU, Ireland)	All platform data
Stripe	Payments and subscriptions	Billing contact data
WorkOS	Enterprise SSO/SAML	Authentication identifiers
Intercom	Customer support (US-hosted — migration in progress)	Support conversations, contact data
Sentry	Error monitoring	Incidental, in stack traces
Google Workspace	Internal collaboration	Data handled by staff
Netlify / Cloudflare	Frontend hosting and delivery	Request metadata
AI/LLM providers (OpenAI, Anthropic, Mistral, Deepseek, X.AI)	AI scheduling/assistant features	Under confirmation — see §7

6. The control environment

• Governance. An ISMS is maintained as version-controlled documentation (SoonHQ/isms), with a document register, defined owners and a weekly security meeting. The Information Security Manager (Olaf Jacobson) is accountable for security.
• Risk management. A documented risk assessment process and register (28 risks, including explicit fraud scenarios) drives control selection via the Statement of Applicability.
• Access control. Least privilege; MFA required on critical systems (AWS, GitHub) under a documented risk-tiered model; SSO where available; quarterly access reviews.
• Change management. All changes via GitHub pull request with peer review and CI gates; main is protected; infrastructure moving to code.
• Operations. Continuous vulnerability scanning (Aikido, Dependabot), centralised logging and alerting, GuardDuty threat detection, documented incident response with a GDPR 72-hour breach-notification procedure.
• People. Confidentiality agreements, security awareness training with a quarterly refresher, documented joiner/mover/leaver process, screening for future hires.
• Monitoring of controls. Independent internal audit (external consultant) plus an in-house continuous control monitoring system (soon-grc) that verifies technical controls automatically and collects the evidence — see ISMS-DOC-09-6.

7. Known limitations and remediation in progress

Stated openly because a Type 1 description must reflect reality.

Item	Status
~~Production database endpoint is publicly reachable~~ — CLOSED 2026-08-19	The public endpoint was removed and the dsync Lambda moved inside the VPC; production CI migrations now run in-VPC as a consequence (soon-server#1675, merged 2026-08-19). Engineers reach the database through SSM Session Manager per ISMS-DOC-A05-37-1. Evidence capture outstanding — PubliclyAccessible: false and the security-group rules must be exported before the audit
No dedicated, log-file-validated CloudTrail	A validated trail is to be created; CloudTrail is otherwise active
Backup restore never tested; PITR disabled; snapshots not isolated off-account	Linear S-327
No MDM/EDR — all endpoints are privately owned	Compensating control: Device Security Standard with quarterly verifiable attestation
Segregation of duties limited — four founders develop, deploy and administer	Detective compensating controls: tamper-evident logging, peer-reviewed change, quarterly access review
No native product MFA for email/password customer accounts	SSO/social login offered; native MFA on the roadmap (risk R-22)
Intercom US-hosted	EU migration — Linear S-303
AI sub-processor data flows not fully confirmed	Under confirmation (OPEN-QUESTIONS Q8)
Most ISMS policies are draft (not yet formally approved)	Approval round in progress

8. Complementary user entity controls

Customers are responsible for: managing their own users and permissions in Soon; choosing and enforcing an authentication method (SSO/social login recommended, since native MFA for email/password accounts is not yet available); the accuracy and lawfulness of the data they enter; and notifying Soon of security concerns via the documented channels.

Related documents

• Context & Scope · Information Asset Inventory
• Statement of Applicability · Risk Assessment Report
• SOC 2 Type 1 Readiness · Security Overview

Change log

Version	Date	Author	Comments
0.1	2026-08-08	ISMS	First draft — SOC 2 system description: service, scope and boundaries, data, infrastructure (verified against live AWS), sub-processors, control environment, known limitations, and complementary user entity controls.