Cloud Services Policy¶
Purpose. Soon runs entirely on cloud services — AWS (production, eu-west-1), GitHub, Stripe, Intercom, Sentry, PostHog, Netlify and others. This policy sets the rules for adopting, using and exiting cloud services so company and customer data stays protected.
1. Scope¶
Applies to every cloud/SaaS service used to store or process Soon or customer data, whether infrastructure (AWS), developer tooling (GitHub) or business SaaS. It applies to anyone who signs up for, configures or administers such services.
2. Policy¶
2.1 Adopting a new cloud service¶
- Company data may only be stored in cloud services that have been approved. Approval must be obtained before sign-up, from the ISM (Olaf Jacobson), who checks data residency, whether customer personal data is involved, and whether a DPA is needed before the service is adopted. (Formerly asked to confirm who approves new cloud services (single approver for a team this size).
- Before approval, the requester completes the due diligence in the Supplier Relationships Security Policy: security assurance (SOC 2 / ISO 27001 where available), data location, DPA if personal data is processed, and sub-processor implications for customer DPAs.
- The service is added to the supplier register / asset inventory with an owner.
2.2 Using cloud services¶
- Data residency: customer personal data must stay in the EU (production in AWS eu-west-1). Services that would move customer data outside the EU need a valid GDPR transfer mechanism before use.
- Access: accounts on cloud services follow the Access Control Policy — SSO where supported and practical, MFA wherever supported, least privilege, offboarding on leaving.
- Encryption: Confidential and Restricted data must be encrypted in transit (TLS 1.2+) and at rest (AES-256) — standard on the approved stack.
- Logging: services holding Confidential/Restricted data must provide audit logging sufficient to investigate unauthorised access.
- Responsibilities: for each service, be clear what the provider does (e.g. physical security, patching of managed services) versus what Soon must do (configuration, access, backups) under the shared-responsibility model.
- Backups: production data in AWS must be backed up per the Backup Policy.
- Destructive, hard-to-reverse actions in cloud consoles (deleting environments, terminating services, restoring over production) require a second person's confirmation.
2.3 Exiting a cloud service¶
When a service is retired: export any data needed, then have the provider delete Soon data per contract; revoke integrations and credentials; update the supplier register and, where relevant, the customer-facing sub-processor list. See the supplier offboarding steps in the Supplier Relationships Security Policy.
3. Roles & responsibilities¶
- Approver (TODO(owner): confirm) — approves adoption of new cloud services.
- Service owner — configures the service securely, manages access, handles exit.
- All staff — do not put company data into unapproved services (see the Acceptable Use Policy).
4. Related documents¶
- Supplier Relationships Security Policy
- Access Control Policy
- Acceptable Use Policy
- Backup Policy
- Information Asset Inventory
Change log¶
| Version | Date | Author | Comments |
|---|---|---|---|
| 0.1 | 2023-12-11 | Olaf Jacobson | First draft document |
| 0.2 | 2026-07-18 | Andrea Cardinali | Tailored to Soon (ISMS overhaul) — grounded in the real SaaS stack, added pre-adoption approval and EU residency requirements |