# CSA CAIQ Lite–style Self-Assessment (SEA Fleet)

**Level:** STAR Level 1–style **self-assessment** (published on our Trust Center; CSA Registry upload optional next).  
**Service:** SEA Fleet B2B SaaS (shore + mobile) · **Operator:** VoxDuru  
**Date:** 2026-07-31 · **Answer key:** Yes = control present · Partial = present with noted limits · No = not claimed

> Honest answers. This is **not** a CSA STAR Registry listing until uploaded to cloudsecurityalliance.org.

## Domains (lite)

| ID | Control theme | Answer | Notes |
|----|---------------|--------|-------|
| AIS | Audit & monitoring | Partial | Auth/error logs; no SIEM SIEM SaaS |
| BCR | Business continuity | Partial | Supabase backups + ≥5y class retention policy; no formal BCP cert |
| CCC | Change control | Yes | Changelog + C/E gate for PMS program updates |
| CEK | Cryptography / keys | Yes | TLS everywhere (LE); platform-managed keys via Supabase/host |
| DCS | Datacenter security | Partial | Inherited from Supabase + Vercel (voxduru.com) |
| DSP | Data security & privacy | Partial | RLS org-scope; privacy/subprocessor doc; no ISO27701 |
| GRC | Governance | Partial | Product policies published; no formal ISMS board |
| HRS | HR security | Partial | Small team; least-privilege ops |
| IAM | Identity & access | Yes | Supabase Auth OTP/magic-link; role gates (C/E vs AB) |
| IPY | Interoperability | Yes | CSV import presets; export ZIP |
| IVS | Infrastructure vuln | Partial | Managed cloud; dependency updates ad hoc |
| LOG | Logging | Partial | App/auth logs; retention limited on free tier |
| SEF | Security incident | Partial | Contact via security.txt; no 24/7 SOC |
| STA | Supply chain | Partial | Named subprocessors; pin major deps |
| TVM | Threat & vuln mgmt | Partial | Manual review + smoke suite |
| UEM | Universal endpoint | N/A | Customer devices; MDM optional post-sale |
| IVS-APP | App security | Partial | RLS + license gate + offline queue design |

## Evidence links
- Trust: https://voxduru.com/sea-fleet/trust/
- TLS: public site https://voxduru.com · A+ (Supabase project host, scan 2026-07-31)
- Headers: MySSL Grade A (2026-07-31 after nginx harden)
- PMS smoke: class-pms-readiness 12/12 PASS