# SendGrid Security Review
# Classification: Confidential
# Date: 2026-06-09
# Reviewer: Claude Code (drafted); pending Founder approval
# Status: Draft

---

## 1. Vendor / Device Overview

| Field | Value |
|---|---|
| **Name** | Twilio SendGrid (a Twilio Inc. service) |
| **Website** | sendgrid.com · trust center: security.twilio.com |
| **Service / purpose** | Transactional email delivery (system-to-mailbox) |
| **CBB use case** | IVR voicemail notification delivery only — `noreply@scope-dope.com` / `noreply@coldboreballisticsllc.com` → operator mailboxes. **Not** used for marketing email. |
| **Data tier(s) accessed** | Tier 2 (General) — voicemail notification contents (caller number, transcription, voicemail metadata) in transit |
| **Access type** | API key (Mail Send scope) called from the Twilio Function; no OAuth, no interactive auth |
| **Proposed onboarding date** | Already in production — retrospective review |

---

## 2. Data Exposure Assessment

### 2.1 What CBB data will this vendor / device access?

- Voicemail notification email contents passing through SendGrid for delivery: caller phone number, voicemail transcription/metadata, the CBB-source headers (`X-CBB-Source`, `X-CBB-Called`, `X-CBB-Category`, `X-CBB-Option`)
- Sender/recipient addresses (`noreply@` → operator mailbox)

No customer accounts, no ballistic data, no SPEC material, no payment data. SendGrid is a transit relay, not a store of record.

### 2.2 Where will CBB data be stored by this vendor?

On SendGrid/Twilio infrastructure transiently for delivery; SendGrid retains activity/event metadata per its retention policy. Encrypted in transit (TLS 1.2) and at rest (AES) per Twilio's security overview. The voicemail content's system of record is the destination mailbox (M365), not SendGrid.

### 2.3 Is any Highly Confidential data (Tier 4) involved?

- [ ] Yes
- [x] **No** — transactional IVR notifications only. No trade-secret or SPEC material.

---

## 3. Vendor Security Posture (Software vendors only)

### 3.1 Compliance and certifications

| Standard | Certified? | Notes |
|---|---|---|
| SOC 2 Type II | Yes | SOC 2 Type II specifically covers SendGrid (per Twilio Trust Center) |
| ISO 27001 | Yes | ISO/IEC 27001; ISO 27018 attested |
| GDPR compliant | Yes | DPA via Twilio legal; ISMS safeguards |
| CCPA compliant | Yes | CCPA/CPRA addressed in Twilio terms |

> Reviewer to confirm current SendGrid-scoped SOC 2 Type II at security.twilio.com at approval.

### 3.2 Data processing agreement

- [x] DPA available via Twilio legal terms (shared Twilio/SendGrid DPA)
- [ ] Not available

### 3.3 Breach history

Inherits Twilio's posture; see Twilio Security Review §3.3. The 2022 Twilio incident had downstream SendGrid implications for some customers via account takeover; CBB uses scoped Mail-Send-only keys stored in Key Vault, limiting exposure. Reviewer to re-check at approval.

### 3.4 Security documentation

- [x] Trust Center published (security.twilio.com)
- [x] SOC 2 report available under NDA
- [x] Responsible disclosure program (shared Twilio)

### 3.5 Authentication and access control

- [x] MFA supported (SendGrid/Twilio console)
- [x] SSO / SAML (paid tier)
- [x] API key scoping — **in use**: `twilio-ivr` key is Mail-Send-only; `claude-code-cli` key is Full Access (operator)
- [x] OAuth/scoped API access

---

## 4. Hardware Security Assessment

**N/A** — software/SaaS vendor.

---

## 5. Integration Security

### 5.1 Credential management

All API keys in Azure Key Vault — none in code or config:

- [x] `twilio-ivr` (Mail Send only) → `kv-cbb-shared-prod` → `sendgrid-twilio-ivr-secret`
- [x] `claude-code-cli` (Full Access, operator) → `kv-cbb-shared-prod` → `sendgrid-claude-code-cli-secret`
- [x] Least-privilege: IVR dispatch key is scoped to Mail Send only
- [x] Keys unique to this integration

**Sender authentication:** `scope-dope.com` and `coldboreballisticsllc.com` are domain-authenticated via DKIM/SPF CNAMEs in Namecheap DNS — mail from `noreply@` passes DKIM/SPF and is trusted by M365 and external receivers.

### 5.2 Network exposure

Outbound API call from the Twilio Function to SendGrid; outbound SMTP delivery from SendGrid to mailboxes. No inbound firewall rule or public IP on CBB infrastructure. No inbound parse webhook configured *(reviewer to confirm)*.

### 5.3 Offboarding plan

Revoke: delete both API keys from Key Vault, remove the domain authentication records, repoint or disable the IVR Function's mail step. For a ScopeDOPE-only sale, only the `scope-dope.com` authenticated domain and the `twilio-ivr` key transfer; `coldboreballisticsllc.com` authentication stays with CBB Corporate.

---

## 6. Risk Summary

| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Voicemail-notification PII exposed via vendor breach | L | M | Transit-only; Tier-2; SOC 2/ISO vendor; system of record is M365 mailbox |
| Full-Access operator key leakage | L | M | Key in Key Vault, never in code; rotate; scope IVR key to Mail-Send-only (done) |
| Sender-domain spoofing / phishing from our domains | L | M | DKIM/SPF/DMARC enforced; domain authentication active |

**Overall risk rating:** **Low**

**Recommendation:** **Approve with conditions** — pending Founder sign-off.

**Conditions:**
1. Confirm current SendGrid-scoped SOC 2 Type II at approval.
2. Confirm no unintended inbound parse webhook is configured.
3. Confirm DMARC alignment is enforced for both sender domains.
4. Add SendGrid to the "CBB Risk Register" SharePoint List (or note coverage under the Twilio entry).

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (`03_-_Confidential/`) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/SendGrid/SendGrid_Security_Review.md` |
| **Cross-references** | `SendGrid_Architecture_Reference.md`; `SendGrid_Acquisition_Brief.md`; `Twilio_Security_Review.md`; `Azure_Key_Vault_Architecture_Reference.md`; "CBB Risk Register" SharePoint List |
| **Created** | 2026-06-09 |
| **Last updated** | 2026-06-09 |
| **Next full review due** | 2027-06-09 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| DRAFT | 2026-06-09 | Claude Code | — | — | Initial draft. Posture verified against Twilio/SendGrid Trust Center (SOC 2 Type II SendGrid-scoped, ISO 27001/27018, GDPR). Documents Mail-Send-only key scoping and DKIM/SPF domain auth. Recommends Approve with conditions. Version number to be assigned by Founder. |
