External documents received

Purpose. Log of externally-originated documents the ISMS depends on — auditor checklists, customer questionnaires, supplier reports. Required by Control of Documented Information §7 (clause 7.5.3 — control of external documents).

Received	From	Document	File	Status
2026-08-07	GetAgency (Aman) — SOC 2 Type 1 examiner	Open Standards SOC 2 Type 1 Checklist — 68 controls, CC1–CC9 (Security TSC)	2026-08-07-getagency-soc2-type1-checklist.xlsx	Filled in from the ISMS — see the mapping

Handling rules

• These are read-only records of what we received — do not rewrite an external document's content; track our responses in our own documents instead.
• Never store a copy containing customer personal data or secrets in this repo (see AGENTS.md); reference the controlled location instead.

GetAgency penetration test — Work Order (signed 2026-09-01)

File	What	SHA-256
2026-09-01-getagency-pentest-work-order-signed.pdf	Agency Penetration Test Work Order, executed by Olaf Jacobson for Soon Technologies B.V. via Atlas. Scope = the targets in the submitted questionnaire (production, app.soon.works + API). Governed by the Agency Cybersecurity Services Agreement.	94ffe88c1ce83a08cef44258913178bda378bbccc571bcc6765dc24d4bee930f
2026-09-01-getagency-pentest-work-order-signing-certificate.pdf	Atlas Certificate of Completion: 1 signer, integrity verified, 13-event SHA-256 hash chain. Carries the original and signed document hashes.	8b72b3d5fe820d2d5790004254115d3dca6c47107e6d0b09d9fa6625c6ecdd60

Engagement dates confirmed by GetAgency (Luke Parry, 2026-09-01): active testing 14–21 September 2026 (2–3 days), report delivery 29 September 2026. Pentester source IPs to allowlist: 146.70.186.37, 65.247.33.131 (allowlisted throughout, per the pentester's preference). Rules of engagement and data-handling instructions are in the questionnaire and the e-mail thread of 2026-08-31 – 2026-09-01, filed in Google Drive → security. Procedure: ISMS-DOC-A08-8-2.