You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Make it easy for organizations that self-host The Desk to pass their own SOC 2 and ISO 27001 audits.
Framing (important — read first)
SOC 2 and ISO 27001 certify an organization's people, processes, and infrastructure — not a piece of software. The Desk is a self-hosted product: the audited entity is always the adopter's company running their own deployment, on their own infrastructure. There is nothing at the project level to "certify," and this project is not pursuing certification.
What we can do — and what this epic covers — is ship the controls, evidence surfaces, and documentation an auditor asks an adopter for, so their audit is straightforward. This is the same path taken by Mattermost, Rocket.Chat, GitLab, and Nextcloud.
Out of scope: certifying the app itself; any hosted/SaaS operation (The Desk is self-hosted only, so no auditor engagement / GRC tooling track).
#418, #420, #422, #423, #425, #426 can be picked up immediately with no dependency. #427 is unblocked but should be scoped first. Start with #425 + #426 for the fastest visible progress, and #418 (2FA) as the highest-impact feature.
Not pursued
In-app instance/server-operator admin role (separation of duties). For a self-hosted deployment the operator already has full infrastructure access (shell / env / database), so a dedicated in-app super-admin adds little for a single-org install. Deliberately excluded.
Goal
Make it easy for organizations that self-host The Desk to pass their own SOC 2 and ISO 27001 audits.
Framing (important — read first)
SOC 2 and ISO 27001 certify an organization's people, processes, and infrastructure — not a piece of software. The Desk is a self-hosted product: the audited entity is always the adopter's company running their own deployment, on their own infrastructure. There is nothing at the project level to "certify," and this project is not pursuing certification.
What we can do — and what this epic covers — is ship the controls, evidence surfaces, and documentation an auditor asks an adopter for, so their audit is straightforward. This is the same path taken by Mattermost, Rocket.Chat, GitLab, and Nextcloud.
Out of scope: certifying the app itself; any hosted/SaaS operation (The Desk is self-hosted only, so no auditor engagement / GRC tooling track).
Already in place (baseline — no work needed)
The Desk already ships a strong control set:
spatie/laravel-activitylog, append-only (model-level guard throwsAuditLogImmutableException), team-scoped, Admin/Owner UI, 365-day retention.AUTH_SSO_ONLYenforcement,deactivated_at.uncompromised()) and login throttling.Child issues
Access control:
Audit & evidence:
WorkspaceSeederDocumentation & policy:
SECURITY.mdand vulnerability-disclosure policyneeds-scoping)Related (already tracked):
Suggested order
The children are mostly independent. Recommended sequencing:
Wave 1 — start now, no blockers (parallelizable). Everything here can begin immediately:
SECURITY.md), ci: add CodeQL and dependency security scanning #426 (CodeQL).needs-scopingquestions before implementing.Wave 2 — after a specific predecessor:
Wave 3 — finalize last:
Unblocked right now
#418, #420, #422, #423, #425, #426 can be picked up immediately with no dependency. #427 is unblocked but should be scoped first. Start with #425 + #426 for the fastest visible progress, and #418 (2FA) as the highest-impact feature.
Not pursued