What is coming, and when.
Every control is mapped to a phase trigger. Phases tie to revenue or customer-tier signals, not arbitrary calendar dates. We surface the gaps as honestly as the wins.
| Control | Phase 1 (now) pre-revenue | Phase 3 mainnet + AI agents | Phase 4 first enterprise pilot | Phase 5 x402 + bug bounty | Phase 6 first enterprise MSA |
|---|---|---|---|---|---|
| Encryption at rest | Supabase native AES-256, S3 SSE-S3 audit log | S3 Object Lock with SSE-KMS, Postgres pgcrypto | AWS KMS CMK, FIPS 140-3 Level 3 HSM | Per-tenant KMS aliases, rotation alarms | BYOK key import; XKS for never-leaves-HSM tier |
| Encryption in transit | TLS 1.3 via Cloudflare, HSTS preload | mTLS internal between Fargate services | TLS 1.2 minimum enforced, weak cipher disable | mTLS for x402 Solana/Base settlement | TLS 1.3 only, zero-trust ingress |
| Multi-Factor Authentication | Enforced on all admin (GitHub, Supabase, AWS, Cloudflare) | Same | Customer SSO (SAML 2.0 + OIDC) | Same | Same + customer IP allowlisting |
| Privileged Access Management | Standing access via Supabase + AWS IAM | Same; documented access matrix | Teleport JIT elevation for production (~A$15/user/mo) | Same | Same + designated security officer review |
| Static Application Security Testing | GitHub CodeQL + Dependabot per PR (free) | Add Semgrep Pro every PR (A$30-45/contributor/mo); block-merge on Critical | Same | Same | Same + threat-model verification per major release |
| Dynamic Application Security Testing | None | Manual checklist | StackHawk Pro weekly authenticated scans (A$42-60/contributor/mo) | Same + on-major-release scan | Same |
| Penetration testing | None | None | Annual external CREST AU certified (CyberCX, A$15-25K) | Annual + on-major-release re-test; bug bounty live | Annual external + annual red team |
| Bug bounty programme | security.txt RFC 9116 (free) | Same | Immunefi for smart contracts (mainnet trigger; pool A$10K+) | + HackerOne private app bounty (A$50K MRR trigger) | Public bounty, escalating payouts |
| Compliance automation platform | None | Drata Foundation (A$7.5-15K/yr) | Same; SOC 2 Type I observation begins | Upgrade to Vanta if AU auditor coverage demands | Same |
| Independent attestations | None | None | SOC 2 Type I (A$15-25K, 4-6 wks) | SOC 2 Type II (12-mo observation) + ISO 27001 Stage 1 | ISO 27001 certified + ISO 27701 (privacy) |
| Government-tier (IRAP) | Not in scope | Not in scope | Not in scope | Not in scope | On customer pull only (A$40-100K, 6-10 wks) |
| Audit log | Postgres append-only invariant (case_events) + 7yr retention | S3 Object Lock Compliance Mode (separate AWS account); cross-region replication ap-southeast-4 | Same + KMS access logging in CloudTrail | Optional Merkle-root sidecar for SOC 2 CC4.1 evidence | Customer BYO-SIEM stream via signed webhook |
| Backup + Disaster Recovery | Supabase PITR + daily logical backup | Cross-region replication ap-southeast-2 → ap-southeast-4 | Quarterly restore-from-backup verification | Annual tabletop exercise + RPO ≤ 4h, RTO ≤ 8h verified | Annual live failover exercise (Tier 1) |
| Cyber + D&O insurance | None | None | Bind on first paid enterprise pilot signal (A$5-20K/yr) | Renew + adjust limits to ARR scale | Same |
Budget envelope
Phase 1 (now): A$0-2K. Cloudflare WAF, GitHub CodeQL, security.txt.
Phase 3: A$15-25K. Drata Foundation, Semgrep Pro, StackHawk Pro, Trivy CI hardening.
Phase 4: A$35-55K. SOC 2 Type I prep + first CREST pen test + Teleport + cyber insurance bind.
Phase 5: A$60-110K. SOC 2 Type II + ISO 27001 + bug bounty pool + advanced tooling.
Phase 6: A$200-350K/yr ongoing. ISO 27701 + DPIA + customer-pull IRAP + annual red team.
Cumulative through Phase 6 (5-year horizon): A$395-682K. Sanity check: mid-market AU SaaS at A$1-5M ARR allocates 5-10% of revenue to security; Ironbark at A$1M+ ARR Phase 5 target lands in the centre of that band.
Last reviewed: 2026-04-25.
Source: /security · Vendor Security Posture document v1.0 (project repo)