System description (draft)
Sign-off: approved by [Kyle] on [date], second reader [Dan] on [date]; recorded in approvals.md. Review yearly.
Lucent Axis, SCOPE. Draft 28 Oct 2026 for ORG-10, arranged in the order of the AICPA's description criteria (DC 200) so it can become Section III of the report. Owner: Kyle, with Dan. Facts are taken from the repository and the system inventory; where a fact waits on Step 0 it says so. The auditor reads this first and tests the rest against it, so every sentence below must stay true.
1. Company and service
Lucent Axis builds SCOPE, a safety and risk management platform for waste and recycling operators: hauling depots, landfills and recycling centres. Drivers file daily vehicle inspections (DVIRs) and incident reports on shared tablets, often with no signal; supervisors record observations and run investigations; managers and executives read dashboards of incidents, corrective actions, training and qualifications across their sites.
2. Principal service commitments and system requirements
Commitments made to clients, in the contract and DPA (VN-5, counsel to finalise):
- Security: each client's data is reachable only by that client's users, each limited to their role and sites; our staff reach it only for support and only with MFA.
- Confidentiality: health, identity, pay and investigation data is classified Confidential and handled as the classification policy says; it is deleted at contract end on request.
- Availability: the service is monitored from outside, backed up daily, and restored within the targets in the BC/DR plan. Today the RPO is up to 24 hours, since point-in-time recovery is off (read 28 Oct; AV-2 decides), and the RTO target is 4 hours. Capture keeps working offline and uploads when a signal returns.
System requirements that follow: row-level security on every table the API exposes, MFA on every account, changes only through pull requests with passing checks, reviewed monthly by the security owner, encryption in transit and at rest, a tested restore, and an incident response within the contract's notice window.
3. Components of the system
Infrastructure. Hosted entirely on two subservice organisations, Supabase and Vercel, with the code on GitHub; Lucent Axis runs no servers and no offices hold client data.
| Component | Provider | Role |
|---|---|---|
| Web application hosting and server functions | Vercel (US region iad1) |
Serves the app; runs the few server functions (Spotter, /api/health) |
| Database, sign-in, file storage | Supabase, on Amazon Web Services | Postgres with row-level security, Supabase Auth, private Storage buckets |
| Source code and CI | GitHub (lucent-axis organisation) |
Code, pull requests, the required checks |
| AI model for Spotter (optional add-on) | Anthropic for the demo; AWS Bedrock in client builds | Reads a VP's typed question; receives no database rows |
Software. One Next.js web application (apps/web) for every role and device, with shared
business rules (packages/core) and data access (packages/db). The browser talks to the
database through Supabase's API under the user's own session; the database's policies decide
what each user may read and write, and every write goes through a database function that
checks the rules again. An installable offline mode queues inspections on the tablet until the
server confirms them.
People. A security owner (Kyle) and a platform and app owner (Dan), named in the information security policy, with each other as backup. Contractors, when engaged, follow the same joining and leaving checklists.
Procedures. The policies in docs/compliance/ (information security, change management,
data classification and retention, BYOD, incident response, BC/DR, joining and leaving, vendor
management, risk) and the control calendar that shows them operating.
Data. Each client's safety records: people and their qualifications, sites and vehicles, inspections and defects, incidents, observations, corrective actions and tasks, training, and the documents and photos attached to them. Confidential fields are listed in the classification policy. The demonstration environment holds synthetic data only.
4. Boundaries
The audit boundary (Dan, 28 Oct): everything in a Lucent Axis account, and nothing else. Dan's personal GitHub repo, Vercel projects and Supabase project are Paul's demo on synthetic data and are not tested against the requirements.
In: the SCOPE web application and its add-ons where switched on, each client's database, sign-in and file storage, the code repository and its CI, and the company accounts that administer them.
Out: COFI and the financial dashboards (ORG-35, until a client asks), the internal hub
(/hub, not built into a client deployment), the clients' own systems and devices, and
everything on Dan's personal accounts (the demo Paul runs, on synthetic data).
Carved out: physical and environmental security, and the infrastructure underneath the hosted services, are the subservice organisations' (CC6.4): Supabase (on Amazon Web Services) and Vercel. Their own SOC 2 reports are read yearly (subprocessors.md). GitHub holds the code and runs CI but no client data; it is a vendor whose SOC 2 report we also read yearly, not a carved-out subservice organisation.
5. Complementary subservice organisation controls
We rely on the subservice organisations to: restrict physical access to their data centres; encrypt data at rest; keep the platforms patched; run and retain backups as configured; enforce the MFA and roles we set on their accounts; and notify us of a breach that affects our data.
6. Complementary user entity controls (what each client must do)
- Tell us at once when a user leaves or changes role, or remove them in the app themselves.
- Keep their shared tablets locked down and signed out at shift end.
- Choose who in their organisation holds the GM and VP levels, which see across sites.
- Review the access list we send them each quarter.
- Report suspected misuse of SCOPE to the security contact (TS-3).
7. Incidents and changes in the period
None to report as of 28 Oct 2026. Before the review period begins: the system moves from personal accounts onto Lucent Axis accounts (Step 0, OW-1 to OW-8), and each client receives its own database project (ORG-11).