GodCode

GodCode's own real, currently-operating internal infrastructure and governance controls — not a future or target architecture.

Scope boundary: GodCode has no live, customer-facing production deployment at the time of this submission. No customer account data, payment data, or regulated personal data is in scope. The real data footprint is limited to inbound business-inquiry submissions, internal governance/audit records, infrastructure telemetry, and self-hosted secrets — no personal or customer data.

Deployment: Infrastructure-as-a-Service (Vultr Cloud), not owned datacenters. Two production hosts plus a locally-controlled operator workstation. Key-only SSH, zero-trust private networking (Tailscale), deny-by-default cloud firewall on both hosts. One Azure App Service hosts an internal console with public network access disabled.

Governance: single-operator (CTO) owned. Git-based, ADR-gated change control. An Agent Identity Registry and MFA-enrolled approval workflow govern every automated/AI component's actions, with an append-only audit trail for all autonomous activity.

Vendors: Vultr (IaaS, independently SOC 2/ISO-certified), Namecheap (DNS), GitHub (source control), Microsoft Azure (one internal console), Anthropic (API provider, narration-only, no training on customer data).

This is a Level 1, self-certified assessment — not a SOC 2 report or a claim of production-grade customer-service readiness.