SOC 2 Type II — Security, Availability, Confidentiality
1. Purpose and Scope
This document establishes the formal data definition and classification framework for DCKAP Integrator, an Integration Middleware platform that transfers and transforms data between enterprise systems (such as eCommerce and ERP platforms) via their APIs. It satisfies the SOC 2 Trust Services Criteria related to logical access, data handling, and confidentiality controls.
1.1 Objectives
Define all categories of data processed by DCKAP Integrator.
Classify data by sensitivity to guide handling, retention, and security controls.
Identify data sources, destinations, and transformation points.
Specify data quality criteria to ensure accuracy and integrity during transit.
Provide an auditable reference for SOC 2 Type II assessors.
1.2 Applicability
This policy applies to all data processed, transmitted, stored, or transformed by DCKAP Integrator, including data flowing through customer-configured integration pipelines, the product portal, API connectors, and internal platform infrastructure.
2. System Overview — DCKAP Integrator
Product
DCKAP Integrator
Type
Integration Middleware (iPaaS)
Function
Bidirectional data transfer and transformation between source and destination systems via REST/SOAP APIs
Example
eCommerce platform (Magento, Shopify) ↔ ERP system (SAP, NetSuite, Acumatica)
Portal
Web-based configuration UI where users define data flows, field mappings, and business logic
2.1 High-Level Data Flow
SOURCE SYSTEM
eCommerce / ERP / Custom API →
DCKAP INTEGRATOR
Transform • Route • Log →
DESTINATION
ERP / WMS / Other
3. Data Categories and Classification
DCKAP Integrator processes data across four primary functional categories. Each category is assigned a sensitivity classification that governs how it must be handled, encrypted, logged, and retained.
3.1 Classification Tiers
Classification
Label
Description
Handling Requirement
Tier 1 — Critical
RESTRICTED
PII, credentials, payment data
Encrypt at rest & transit; mask in logs; strict RBAC
Tier 2 — Sensitive
CONFIDENTIAL
Business transactions, pricing, inventory
Encrypt in transit; limited access; audit logged
Tier 3 — Internal
INTERNAL
Configuration, field mappings, workflow rules
Access-controlled; not publicly exposed
Tier 4 — Operational
PUBLIC / OPS
System health metrics, anonymised logs
Standard monitoring practices
3.2 Data Category Detail
Category A — Transactional Business Data
Data elements exchanged between eCommerce and ERP systems during normal business operations.
Data Element
Source System
Destination
Classification
Retention
Order ID / Number
eCommerce
ERP
CONFIDENTIAL
7 years
Order Line Items
eCommerce
ERP
CONFIDENTIAL
7 years
Customer Name
eCommerce
ERP
RESTRICTED
7 years
Shipping Address
eCommerce
ERP
RESTRICTED
7 years
Product SKU / UPC
ERP / eComm
Both
CONFIDENTIAL
7 years
Pricing / Discounts
ERP
eCommerce
CONFIDENTIAL
7 years
Inventory Levels
ERP
eCommerce
CONFIDENTIAL
90 days
Invoice Data
ERP
eCommerce
CONFIDENTIAL
7 years
Payment Status
eCommerce
ERP
RESTRICTED
7 years
Shipment Tracking
WMS / 3PL
eCommerce
INTERNAL
90 days
Category B — Customer Personal Data (PII)
Personally Identifiable Information transferred as part of order or account synchronisation. This category carries the highest sensitivity and requires the strictest controls.
Data Element
Example Value
Source
Classification
Special Handling
Full Name
John Smith
eCommerce
RESTRICTED
Mask in logs
Email Address
j@example.com
eCommerce
RESTRICTED
Mask in logs
Phone Number
+1-555-000-0000
eCommerce
RESTRICTED
Mask in logs
Billing Address
123 Main St
eCommerce
RESTRICTED
Mask in logs
Shipping Address
456 Oak Ave
eCommerce
RESTRICTED
Mask in logs
Customer Account ID
CUST-00123
ERP
CONFIDENTIAL
Standard logging
Tax ID / VAT Number
GB123456789
ERP
RESTRICTED
Mask in logs
Category C — Integration Configuration Data
Data created by customers in the DCKAP Integrator portal to define data flows, field mappings, transformation rules, and business logic. This data controls platform behaviour and must be protected against unauthorised modification.
Element
Description
Classification
Owner
API Credentials
OAuth tokens, API keys for connected systems
RESTRICTED
Customer
Field Mappings
Source-to-destination field transformation rules
INTERNAL
Customer
Business Rules
Conditional logic, filters, data enrichment rules
INTERNAL
Customer
Workflow Schedules
Sync frequency and trigger configuration
INTERNAL
Customer
Connection Profiles
System endpoint URLs and auth methods
CONFIDENTIAL
Customer
Error Handling Rules
Retry logic, alert thresholds
INTERNAL
Customer
User Roles & Permissions
Portal access control settings
CONFIDENTIAL
Customer Admin
Category D — Platform Operational Data
System-generated data used for monitoring, debugging, audit, and performance management of the DCKAP Integrator infrastructure.
Element
Description
Classification
Retention
Sync Execution Logs
Timestamps, record counts, job status
INTERNAL
90 days
API Request / Response Logs
HTTP status, payload size (PII masked)
INTERNAL
30 days
Error & Exception Logs
Stack traces, failed record IDs
INTERNAL
90 days
Audit Trail
User actions in portal — who changed what/when
CONFIDENTIAL
1 year
Performance Metrics
Latency, throughput, queue depth
INTERNAL
30 days
Security Events
Auth failures, unusual access patterns
CONFIDENTIAL
1 year
System Health Metrics
CPU, memory, uptime (anonymised)
INTERNAL
30 days
4. Data Sources and Destinations
System Type
Example Platforms
Connection Method
Data Direction
Auth Mechanism
eCommerce Platform
Magento, Shopify, BigCommerce, WooCommerce
REST API
Bidirectional
OAuth 2.0 / API Key
ERP System
SAP, NetSuite, Acumatica, Microsoft D365
REST / SOAP API
Bidirectional
OAuth 2.0 / API Key
Warehouse Mgmt (WMS)
Fishbowl, Infor WMS
REST API
Inbound to eComm
API Key
PIM / Product Data
Akeneo, Salsify
REST API
Outbound to eComm
API Key
Shipping / Logistics
ShipStation, FedEx
REST API
Outbound
API Key
DCKAP Integrator Portal
Internal web application
HTTPS (browser)
Configuration only
SSO / MFA
Monitoring / SIEM
Internal observability stack
Internal API
Outbound metrics
Service account
5. Data Quality Criteria
DCKAP Integrator enforces the following data quality dimensions at each processing stage to ensure data integrity from source to destination.
Dimension
Definition
Enforcement Mechanism
Failure Handling
Completeness
Required fields must be present
Schema validation pre-transform
Reject record; log error; alert
Accuracy
Field values conform to expected format and range
Regex / type validation rules
Reject or quarantine record
Consistency
No conflicts between related fields (e.g., order total = sum of lines)
Cross-field validation rules
Flag for manual review
Timeliness
Data transferred within configured SLA window
Sync schedule monitoring
Alert on breach; retry logic
Uniqueness
No duplicate records pushed to destination
Deduplication via record key
Skip duplicate; log warning
Integrity
Referential integrity maintained (e.g., order has valid customer ID)
FK validation against destination
Hold record; notify admin
Validity
Enumerated values within allowed domain (e.g., valid country codes)
Allow-list validation
Map to default or reject
6. Data Transformation Controls
When DCKAP Integrator transforms data between systems, the following controls ensure the process is auditable and reversible.
6.1 Transformation Types
Field mapping — rename or reorder fields to match destination schema.
Data type conversion — convert formats (e.g., date format, currency precision).
Value translation — map source values to destination equivalents (e.g., status codes).
Aggregation — combine multiple source records into a single destination record.
Enrichment — append calculated or lookup values before delivery.
Filtering — suppress records that do not meet configured business criteria.
6.2 Transformation Audit Requirements
Every transformation step is logged with: input payload hash, transformation rule applied, output payload hash, and timestamp.
PII fields are masked in all transformation logs.
Configuration changes to transformation rules are captured in the portal audit trail with the user identity and timestamp.
Rollback of transformation rule changes is supported via versioned configuration history.
7. SOC 2 Trust Services Criteria Mapping
The following table maps this document’s controls to the relevant SOC 2 Common Criteria (CC) and Additional Criteria.
Criteria
Title
How This Document Addresses It
CC6.1
Logical Access Controls
Classification tiers define who may access each data category; API credentials are Tier 1 RESTRICTED.
CC6.7
Transmission of Data
All data transfers occur over TLS; encryption requirements defined per classification tier.
CC7.2
Monitoring of System Operations
Operational data category (Category D) defines log retention and monitoring requirements.
CC9.2
Third-Party Risk
Data source/destination table identifies all external system integrations and their auth mechanisms.
A1.2
Availability Monitoring
Timeliness quality criterion and SLA monitoring controls defined in Section 5.
C1.1
Confidentiality Commitments
PII classified as RESTRICTED; masking, encryption, and retention controls specified.
PI1.1
Privacy — Data Classification
Personal data category (Category B) separately defined with enhanced controls.
8. Roles and Responsibilities
Role
Responsibility
CISO / Security Team
Own and annually review this policy; approve classification changes; oversee compliance with SOC 2 requirements.
Engineering / Platform Team
Implement technical controls (encryption, masking, validation) as defined by classification tiers.
Customer Success / Onboarding
Inform customers of data handling obligations; ensure appropriate data is configured in integration flows.
Customers (Data Controllers)
Responsible for the legality of data they configure to flow through DCKAP Integrator; must not route data in violation of their own privacy obligations.
QA / Audit Team
Validate that controls described in this document are implemented and effective; support SOC 2 assessors.
