Internal Audit Report — 2026 Q2

§1 Audit objective

Assess whether the PortalPilot information security management system (in-scope assets per the public scope statement §2) operates effectively against:

1. The control objectives of ISO/IEC 27001:2022 Annex A (when published in the upcoming compliance pack release).
2. The five SOC 2 Trust Service Criteria as documented in the equivalence map.
3. The HubSpot Marketplace pre-submission security baseline (driver for the original Sweep 1 cadence).
4. The customer-facing DPA commitments, particularly the 72-hour breach-notification commitment and the sub-processor-list reconciliation.

The audit's secondary objective is to surface defects in the agent-security model (Claude Code + Mistral second-opinion), since the agent itself is part of the in-scope security boundary.

§2 Scope

The audit covered the entirety of the in-scope-assets section of the public scope statement §2, namely:

• §2.1 Production application — all React routes, all Supabase Edge Functions, all Postgres schemas + RLS policies, the customer-facing authentication service.
• §2.2 Customer data — every PII-bearing column in every customer table, traced through the full data flow (HubSpot OAuth → edge function → Postgres → frontend).
• §2.3 Operational infrastructure — the production VM (Hetzner Cloud Finland), the self-hosted Supabase stack, the Coolify orchestration plane, the Plausible analytics instance, the Traefik reverse proxy.
• §2.4 Sub-processors — the four sub-processors listed in the public DPA Annex I (Hetzner, Mistral, Mollie, Lettermint).
• §2.5 Engineering tooling — the four-layer agent-security model and its known limitations.

Out-of-scope (per the public scope statement §3): the founder's development laptop, HubSpot Inc. as a vendor, customer-side HubSpot portal data at rest in HubSpot.

§3 Methodology

Approach

Adversarial review by the founder, augmented by Claude Code (LLM-driven static-review tool), proceeded domain-by-domain with an attacker-perspective lens. For each domain the methodology was:

1. Code-path enumeration — list every public-reachable code path (React route, edge function, public RPC).
2. Auth + ownership verification — for each path, verify that authentication is enforced and that data-ownership checks gate every read/write of customer-scoped data.
3. Input-validation review — verify that every parameter accepted from the network is type-checked, range-checked, and denied-by-default for unrecognised shapes.
4. Error-handling review — verify that errors return generic messages to the client; full diagnostic detail goes only to the structured log.
5. Side-channel review — examine logs, audit trails, RPC error messages, and HTTP response headers for unintended information disclosure.

Sweep 2 added a fix-verification pass over Sweep 1's HIGH findings, plus extension into payments, CI pipeline, enterprise readiness, and the agent-security model itself.

Limitations of the methodology

• No external penetration test — all findings come from static code review, manual probe-and-observe testing, and LLM-assisted review. Live exploitation is not part of the methodology.
• No formal threat-modelling tool — threats were enumerated narratively per domain, not via a STRIDE / PASTA / LINDDUN tool.
• LLM-assisted review caveat — Claude Code (Opus-tier) was used as a force-multiplier for code reading, finding enumeration, and remediation-plan drafting. Empirical review of Mistral's chunk-review output during recent compliance-pack authoring shows hallucination rates of 31–86 % on individual findings, so every LLM-flagged item was empirically validated by the founder before action. Claude Code itself (Opus tier) had a measurably lower error rate but was still subject to the same per-finding validation discipline.

§4 Findings register — summary

Statistics across both sweeps

All eleven HIGH findings (7 from Sweep 1 + 4 from Sweep 2) closed before pre-marketplace submission. All Sweep-1 HIGH closures were re-verified in Sweep 2 with no regressions.

Top findings — closure detail

The five highest-impact findings and their closure path:

Open items at this report's effective date

Nine items (4 Medium + 5 Low) remain open. None are HIGH-severity. Status snapshot:

The full per-finding evidence and remediation rationale is held in the audit archive, available to enterprise procurement reviewers under NDA.

§5 Annex A control coverage tested

The audit tested controls across all four Annex A themes. Coverage by theme:

Summary coverage: approximately 53 of 93 controls (~57 %) were empirically tested. The remainder were either attested-by-structure (A.6 controls under sole-trader form), transferred-to-supplier (A.7 controls under Hetzner certifications), or governance-tier (A.5.1–A.5.4 attested rather than tested).

§6 Conclusions

The PortalPilot information security management system is operating effectively. All eleven HIGH findings from Sweep 1 + Sweep 2 are closed and re-verified. Nine open items, all Medium-or-Low, are tracked in the engineering backlog with documented rationale or remediation timelines. No CRITICAL findings were surfaced in either sweep.

The most material structural risks — single-server topology, single-founder concentration, no third-party SOC 2 attestation — are inherent to NordScope's current sole-trader stage and are explicitly acknowledged in the public ISMS scope statement (§3 out-of-scope) + the SOC 2 equivalence map (Compensating measures column).

The methodology itself has known limitations (no external pen test, no formal threat-modelling tool, LLM-assisted review with empirical-validation discipline). Phase 2 third-party attestation is deferred until enterprise-customer demand justifies the audit cost.

§7 Next audit due

The Q3 2026 audit will explicitly cover:

1. Verification that this report's nine open items are either closed or have a documented status update.
2. Coverage of any Annex A control rows added or modified since the Q2 audit.
3. Re-test of the agent-security model in light of any changes to Claude Code, Mistral, or the project's hook configuration.
4. Sub-processor list reconciliation against the public DPA Annex I.

§8 Auditor declaration

I, Peter Sterkenburg, in my capacity as founder and sole operator of NordScope, performed the internal audit described in this report between 2026-03-20 and 2026-04-30. The audit was assisted by Anthropic Claude Code (an LLM-driven static-review tool); every LLM-flagged finding was empirically validated by the founder before being recorded as a real finding in the register, and every claimed closure was independently re-verified by the founder in Sweep 2.

This is an internal audit performed under ISO/IEC 27001:2022 clause 9.2. It is not a third-party attestation, certification, or examination by a CPA firm. Procurement reviewers should treat this report as alignment evidence, in the same family as the SOC 2 equivalence map and the public ISMS scope statement.

— Peter Sterkenburg, 2026-04-30

Document history

Linked from NordScope's internal security runbook (NDA counterpart) under the "Annual security tasks" section. The full per-finding evidence base is held in NordScope's audit archive and made available to enterprise procurement reviewers on request.