Create SOC_CONTROL_MAPPING.md

SOC_CONTROL_MAPPING.md

@@ -0,0 +1,70 @@
+# SOC-Style Control Mapping
+
+This document maps application controls to SOC 2–inspired trust principles.
+
+---
+
+## CC1 — Control Environment
+
+| Control | Implementation |
+|------|------|
+| Ethical use | Explicit AI opt-in |
+| Governance | Feature flags & policies |
+| Accountability | Maintainer ownership |
+
+---
+
+## CC2 — Communication & Information
+
+| Control | Implementation |
+|------|------|
+| Transparency | Disclosures in UI |
+| Documentation | README + policies |
+| User awareness | Warnings & tips |
+
+---
+
+## CC3 — Risk Assessment
+
+| Risk | Mitigation |
+|----|----|
+| Data misuse | Public-only scope |
+| AI misuse | Disclosure & hashing |
+| Surveillance | No automation |
+
+---
+
+## CC6 — Logical Access Controls
+
+| Control | Implementation |
+|------|------|
+| Auth | None required |
+| Privilege escalation | Not applicable |
+| Isolation | Session-only memory |
+
+---
+
+## CC7 — System Operations
+
+| Control | Implementation |
+|------|------|
+| Logging | None (privacy-preserving) |
+| Persistence | None |
+| Monitoring | User-visible actions only |
+
+---
+
+## CC8 — Change Management
+
+| Control | Implementation |
+|------|------|
+| Feature flags | ENABLE_* gates |
+| Phase governance | Phase-4 policy |
+| Rollback | Kill-switch support |
+
+---
+
+## Summary
+
+The application aligns with **low-risk SOC 2 principles** by intentionally
+minimizing data handling, persistence, and automation.