> ## Documentation Index
> Fetch the complete documentation index at: https://internal.softcrum.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Annex of Security Measures (TOMs) — DRAFT v0.1

> Organizational. Role-based access with least privilege (RBAC module.resource.action); mandatory MFA in the console and in Ops; time-boxed support impersonation, reason-required and audited, visible to the client; annual training.

> ⚠️ **INFORMATIVE TRANSLATION — NOT BINDING.** The Spanish version at
> [`../../legal/`](/legal/overview) is the authoritative text and the only one that may be signed,
> published or presented to a third party. This English rendering exists so that non-Spanish readers
> can review the content; where the two differ, Spanish governs. Like its original, it is an
> unreviewed working draft — nothing here is legal advice, and nothing is final until a Chilean
> data-protection lawyer has signed off.

**Organizational.** Role-based access with least privilege (RBAC `module.resource.action`);
mandatory MFA in the console and in Ops; time-boxed support impersonation, reason-required and
audited, visible to the client; annual training; supplier policy (DPA with sub-processors).

**Technical.** Multi-tenant isolation (tenant guards + RLS on every table); encryption in transit
(TLS) and at rest (provider); identity-document masking with a dedicated permission and audited
access; immutable audit log with diffs and actor (retention per plan plus legal minimum); end-to-end
traceability by correlation\_id; managed backups plus a tested restore runbook; secret management and
key rotation (including per-tenant token-exchange keys); HMAC signing and SSRF protection on
webhooks; rate limiting and abuse detection; separated environments (local/dev/cert/prod); dependency
review with a lockfile allowlist; load testing with p95 budgets as a certification gate; a 72-hour
breach response plan with quarterly drills.