Cryptographic Non-Repudiation for SOC 2 & ISO 27001: SHA-256 Audit Logs (2026)

export interface VendorDpaRequest {
  vendorId: string;
  vendorLegalName: string;
  vendorSecurityContactName: string;
  vendorSecurityContactEmail: string;
  dataClassification: "PII_CONFIDENTIAL" | "RESTRICTED_FINANCIAL" | "OPERATIONAL_METADATA";
  awsRegion: string;
}

export async function dispatchVendorDpaForSoc2(req: VendorDpaRequest) {
  const dpaMarkdown = `# Data Processing Addendum (SOC 2 CC9.2 & ISO 27001 A.5.20)

This Data Processing Addendum ("DPA") is entered into between **Acme Cloud Inc.** ("Controller") and **${req.vendorLegalName}** ("Processor").

### 1. Security & Cryptographic Controls (ISO/IEC 27001:2022 A.8.24)
Processor warrants that all Controller data classified as **${req.dataClassification}** shall be encrypted at rest using AES-256-GCM and in transit via TLS 1.3 within region **${req.awsRegion}**.

### 2. Breach Notification SLA (SOC 2 CC7.4)
Processor shall notify Controller's Security Operations Center (security@acmecloud.io) within **24 hours** of confirming any unauthorized access, acquisition, or disclosure of Controller data.

| Compliance Control | Requirement | Audit Verification Method |
|---|---|---|
| **SOC 2 CC9.2** | Subprocessor Risk Assessment | Annual SOC 2 Type II Bridge Letter |
| **ISO 27001 A.5.20** | Supplier Information Security | Executed SHA-256 DPA Certificate |
| **GDPR Art. 28** | Written Processing Instructions | Immutable Appendix A Scope |
`;

  const res = await fetch("https://signb.ee/api/v1/send", {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.SIGNBEE_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      title: `[SOC2-CC9.2] Data Processing Addendum — ${req.vendorLegalName}`,
      markdown: dpaMarkdown,
      sender_name: "Hannah Lin, CISO (Acme Cloud Inc.)",
      sender_email: "ciso@acmecloud.io",
      recipient_name: req.vendorSecurityContactName,
      recipient_email: req.vendorSecurityContactEmail,
      expires_in_days: 14,
      webhook_url: "https://grc-internal.acmecloud.io/webhooks/signbee-soc2",
    }),
  });

  if (!res.ok) {
    throw new Error(`Failed to dispatch SOC 2 Vendor DPA: ${res.status}`);
  }

  const payload = await res.json();
  return {
    vendorId: req.vendorId,
    signbeeDocumentId: payload.id,
    controlMappings: ["SOC2-CC9.2", "ISO27001-A.5.20"],
    status: payload.status,
  };
}

#!/usr/bin/env bash
set -euo pipefail

COMMIT_SHA=$(git rev-parse HEAD)
COMMIT_AUTHOR=$(git log -1 --pretty=format:'%an <%ae>')
COMMIT_SUBJECT=$(git log -1 --pretty=format:'%s')
DIFF_STAT=$(git show --stat --oneline HEAD | tail -n +2)
DEPLOY_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

read -r -d '' CHANGE_MARKDOWN <<EOF || true
# Emergency Production Change Authorization (SOC 2 CC8.1 / ISO 27001 A.8.32)

This record certifies executive authorization for an emergency production hotfix deployed under the Incident Response Break-Glass Procedure.

| Change Control Attribute | Cryptographic / CI Metadata |
|---|---|
| **Git Commit SHA-1** | `${COMMIT_SHA}` |
| **Commit Author** | ${COMMIT_AUTHOR} |
| **Incident / Change Summary** | ${COMMIT_SUBJECT} |
| **CI/CD Workflow Run ID** | `${GITHUB_RUN_ID:-local-run}` |
| **Deployment UTC Timestamp** | ${DEPLOY_TIMESTAMP} |

### Modified Production Files
```
${DIFF_STAT}
```

### Attestation of Post-Deployment Verification
By executing this electronic record, the Approving Officer confirms that automated smoke tests passed, customer data integrity was preserved, and the change complied with Emergency Change Control Policy SEC-POL-008.
EOF

JSON_PAYLOAD=$(jq -n \
  --arg title "[SOC2-CC8.1] Emergency Hotfix Approval — ${COMMIT_SHA:0:8}" \
  --arg md "$CHANGE_MARKDOWN" \
  --arg rname "$INCIDENT_COMMANDER_NAME" \
  --arg remail "$INCIDENT_COMMANDER_EMAIL" \
  '{
    title: $title,
    markdown: $md,
    sender_name: "GitHub Actions Production Release Bot",
    sender_email: "secops-bot@acmecloud.io",
    recipient_name: $rname,
    recipient_email: $remail,
    expires_in_days: 3
  }')

curl -sS -X POST "https://signb.ee/api/v1/send" \
  -H "Authorization: Bearer ${SIGNBEE_API_KEY}" \
  -H "Content-Type: application/json" \
  -d "$JSON_PAYLOAD"

import hashlib
import json
import os
import urllib.request
from datetime import datetime, timezone

SIGNBEE_API_KEY = os.environ["SIGNBEE_API_KEY"]

def collect_soc2_non_repudiation_bundle(document_id: str, control_id: str) -> dict:
    """
    Retrieves the JSON audit trail and sealed PDF from Signbee, verifies that the
    binary PDF matches the Pass-2 SHA-256 digest on the Signing Certificate, and
    formats a deterministic evidence manifest for Vanta / Drata / CPA auditors.
    """
    api_url = f"https://signb.ee/api/v1/documents/{document_id}"
    req = urllib.request.Request(
        api_url,
        headers={
            "Authorization": f"Bearer {SIGNBEE_API_KEY}",
            "Accept": "application/json",
        },
    )
    with urllib.request.urlopen(req, timeout=15) as response:
        doc = json.loads(response.read().decode("utf-8"))

    if doc.get("status") != "SIGNED":
        raise RuntimeError(f"Compliance artifact {document_id} status is {doc.get('status')}, expected SIGNED.")

    expected_sha256 = doc["cryptographic_seal"]["sealed_pdf_sha256"]
    with urllib.request.urlopen(doc["signed_pdf_url"], timeout=30) as pdf_resp:
        pdf_bytes = pdf_resp.read()

    actual_sha256 = hashlib.sha256(pdf_bytes).hexdigest()
    if actual_sha256 != expected_sha256:
        raise ValueError(
            f"INTEGRITY_VIOLATION: SHA-256 mismatch for {document_id}! "
            f"Expected {expected_sha256}, computed {actual_sha256}"
        )

    return {
        "schema_version": "2026.10.grc-non-repudiation",
        "control_framework_mapping": {
            "primary_control": control_id,
            "soc2_criteria": ["CC6.1", "CC7.2", "CC8.1", "CC9.2"],
            "iso_27001_2022_annex_a": ["A.5.20", "A.6.2", "A.8.15", "A.8.24", "A.8.32"],
        },
        "artifact": {
            "signbee_document_id": document_id,
            "title": doc["title"],
            "created_at_utc": doc["created_at"],
            "signed_at_utc": doc["signed_at"],
            "pdf_size_bytes": len(pdf_bytes),
            "sealed_pdf_sha256": actual_sha256,
            "integrity_verified": True,
            "public_verification_url": f"https://signb.ee/verify/{document_id}",
        },
        "signers": doc.get("parties", {}),
        "immutable_audit_events": doc.get("audit_trail", []),
        "collected_by_grc_pipeline_at": datetime.now(timezone.utc).isoformat(),
    }

if __name__ == "__main__":
    evidence = collect_soc2_non_repudiation_bundle("doc_01j9x9p4m2k8v7n1", "SOC2-CC8.1")
    print(json.dumps(evidence, indent=2))