SOC 2 · Controls Alignment (informational)
Last updated July 2026
Important
SOC 2 is an independent audit of an organisation's controls over time, performed by a licensed CPA firm. A website cannot be "SOC 2 compliant" by itself. This page describes controls we align toward, not an attestation.
Security
HTTPS/TLS with HSTS everywhere; passwords hashed with scrypt; direct messages encrypted at rest (AES-256-GCM); database encrypted at rest by the provider; secrets kept out of source control; least-privilege infrastructure access; API input validation and rate limiting.
Availability
Hosted on Vercel's global edge with a documented health endpoint (/api/health); the read layer degrades gracefully to a bundled dataset if the database is unreachable.
Confidentiality
Least-privilege access to infrastructure; private source repository; personal data shared only with the processors listed in our Data Protection Policy; no sale of data.
Processing integrity
Input validation on API routes (zod), rate limiting on the API, and typed data models.
Path to attestation
Formal SOC 2 Type II would require a control framework, evidence collection over a 3–12 month window, and a third-party audit. Tools like Vanta/Drata can automate evidence collection.
These documents are provided in good faith and describe how queer.bar actually works today. They are drafts, not legal advice; have them reviewed by a qualified lawyer and complete the bracketed operator details before relying on them. Compliance with the EU GDPR, UK GDPR / Data Protection Act 2018, the US state privacy laws (incl. CCPA/CPRA) and other applicable regimes is an ongoing organisational responsibility, not something software alone establishes.