# FeedOracle Security Controls
## ISO 27001 Alignment Documentation

**Version:** 1.0.0 | **Date:** January 2026 | **Status:** Design Reference

---

## Disclaimer

Controls *informed by* ISO/IEC 27001:2022 principles.
**NOT:** certification, audit, compliance guarantee, or legal advice.
Organizations responsible for own security assessments.

---

## 1. Scope

FeedOracle provides blockchain sustainability data via REST APIs.
This maps controls to ISO 27001:2022 Annex A.

---

## 2. Annex A Control Mapping

### A.5 Organizational Controls

| Control | Description | Implementation |
|---------|-------------|----------------|
| A.5.1 | Security policies | Terms, Privacy Policy, AGB |
| A.5.15 | Access control | API key auth (X-API-Key header), rate limits |
| A.5.23 | Cloud services | EU residency, Cloudflare, TLS |
| A.5.28 | Evidence collection | On-chain attestations, DAP hashes |

### A.8 Technological Controls

| Control | Description | Implementation |
|---------|-------------|----------------|
| A.8.9 | Configuration mgmt | Versioned APIs, systemd services |
| A.8.13 | Backup | Daily encrypted, cross-server sync |
| A.8.15 | Logging | Request IDs, access logs, monitoring |
| A.8.20 | Network security | TLS 1.2+, HSTS, CSP, firewall |
| A.8.24 | Cryptography | SHA-256, TLS, on-chain anchors |
| A.8.26 | App security | Input validation, rate limiting |

---

## 3. Security Headers

All responses include:
- `Strict-Transport-Security`: max-age=31536000; preload
- `X-Frame-Options`: SAMEORIGIN
- `X-Content-Type-Options`: nosniff
- `X-XSS-Protection`: 1; mode=block
- `Referrer-Policy`: strict-origin-when-cross-origin
- `Permissions-Policy`: geolocation=(), microphone=(), camera=()
- `Content-Security-Policy`: default-src 'self'

---

## 4. Infrastructure

| Component | Implementation |
|-----------|----------------|
| Hosting | netcup DE (Germany) |
| DDoS | Cloudflare |
| TLS | Let's Encrypt, 1.2+ |
| Backups | Daily encrypted |
| Updates | Automated |
| SSH | Key-only auth |

---

## 5. Data Protection

- GDPR compliant
- Residency: Germany/EU
- No transfer outside EU
- Encrypted at rest & transit

---

## 6. Operational Security

- Monitoring: Real-time Telegram alerts
- Status: https://feedoracle.io/status.html
- Incident response: 4 hours
- Disclosure: security@feedoracle.io

---

## 7. Verification

```bash
curl -I https://feedoracle.io/
```

Trust Anchor TX: `0xdb7f5ab85c55a78e9b6d5e202d98bf02fa89cb73f6dd32adf5185d3953b4eeb3`
Chain: Polygon | Verify: https://polygonscan.com

---

## 8. Contact

- Security: security@feedoracle.io
- Enterprise: enterprise@feedoracle.io

---

*Informational only. Not certification or compliance guarantee.*