Skip to main content

Go-Live Audit — Slice D: India Compliance · Security & Tech Readiness

Date: 2026-04-25
Audit Scope: India Regulatory Compliance + Technical Security & Operational Readiness
Total Checks: 96

Executive Summary​

The HMP Hotel PMS is ⚠️ partially ready for go-live. Critical gaps identified in GST invoicing, E-Invoice integration, and PCI scope require immediate resolution.

Scorecard​

Domain✅ Complete⚠️ Partial🔴 Stub❌ MissingP0 Blockers
12. India Compliance812848
13. Security & Tech288221
TOTAL36201069

P0 Go-Live Blockers (36 Days EST)​

  1. GST Exemption — Guest exemption flag not surfaced to invoice logic (2d)
  2. Reverse Charge (RCM) — No RCM flag in folio for B2B >₹5L (3d)
  3. GSTR Export — No monthly GSTR-1 / GSTR-3B export service (5d)
  4. Invoice Numbering — No sequential per FY/branch guarantee (2d)
  5. E-Invoice (NIC API) — Type stubs only; full implementation needed (8d)
  6. Foreigner C-Form — Missing visa fields and export (4d)
  7. TDS/TCS Calculation — No agent commission TDS or luxury rate TCS (3d)
  8. Children's Data Consent — Age check + guardian consent missing (2d)
  9. PCI DSS Scope — No SAQ or ASV assessment (7d)

India Compliance Status​

✅ Complete​

  • GSTIN validation (checksum Luhn-mod-36)
  • SAC code registry (rooms, F&B, events)
  • CGST/SGST split (intra-state) and IGST (inter-state)
  • Aadhaar encryption (AES-256-GCM at rest)
  • Consent capture & DSAR workflows
  • Audit logging with hash-chain integrity

⚠️ Partial​

  • GST exemption (flag exists, logic missing)
  • E-Invoice (types defined, no NIC API)
  • Foreigner check (identity capture, no C-Form export)
  • Data retention (jobs defined, cron not scheduled)
  • TRAI compliance (preference model, DND sync missing)

🔴 Stub / Missing​

  • GSTR export endpoints
  • RCM calculation
  • TDS/TCS withholding
  • NIC API integration
  • C-Form PDF export
  • PCI scope assessment

Security & Tech Readiness​

✅ Complete​

  • Auth: RS256 JWT, MFA (TOTP), password policy (12 chars+complexity), brute-force lockout (exponential)
  • RBAC: Tenant/property isolation enforced, service-account JWT for internal calls
  • Audit: Tamper-evident logs with SHA-256 hash chain, 7-year retention, sensitive action logging
  • Data: SQL injection protection (Prisma ORM), XSS protection (React + CSP), foreign-key constraints
  • Backup & DR: Daily RDS snapshots, PITR enabled, RTO <1h, RPO <5min, monthly restore test
  • Operational: CSP headers (nonce-based, no unsafe-inline), CORS policy, rate limiting, health checks, circuit breakers
  • Encryption: AES-256-GCM field encryption, MFA secret encryption at rest

⚠️ Partial​

  • RBAC Matrix: Roles defined; permission matrix scattered across services (P1)
  • Observability: Sentry integration stubbed; error monitoring not enabled (P1)
  • Performance: Load test scenarios exist; P95 baselines not published (P1)
  • WAF: Rules defined; not deployed to production (P1)
  • Compliance: Data retention rules defined; cron job not scheduled (P1)
  • PII Redaction: No explicit log filter; DB encryption only (P1)
  • Cross-Region: Terraform modules exist; not deployed (post-launch)

🔴 Missing​

  • PCI Compliance Scoping: No SAQ or ASV assessment
  • Card Data Audit: No verification that card BIN/last-4 not in logs
  • Concurrent Locking: Order total recalc not locked (race condition possible)

P1 Should-Fix (26 Days EST)​

  • Exempt guest type filtering (1d)
  • Composite GST bundling (2d)
  • DSAR bulk export (1d)
  • Email unsubscribe management (1d)
  • DLT registration (TRAI) (2d)
  • Breach notification SLA test (1d)
  • Impersonation audit logging (1d)
  • Card data storage audit (1d)
  • Permission matrix centralization (3d)
  • Role-based UI rendering (2d)
  • Concurrent-write locking (2d)
  • Load test documentation (1d)
  • Sentry integration (1d)
  • WAF production deployment (2d)
  • Log PII redaction (2d)
  • File upload validation (1d)
  • S3 signed URL expiry (1d)

Code Evidence​

GST & Tax:

  • — GSTIN validation
  • — GST calculation
  • — SAC registry
  • — Tax engine

Data Protection:

  • — DPDPA requests
  • — DSAR workflows
  • — Retention rules
  • — Consent capture

Auth & Security:

  • — JWT, MFA, brute-force (lines 39–100)
  • — Password validation
  • — AES-256-GCM encryption
  • — Audit hash chain

Operational:

  • — CSP headers
  • — Health checks
  • — Backup testing
  • — DR documentation

Remediation Timeline​

Phase 1 (6 weeks): GST infrastructure, E-Invoice NIC, FRRO C-Form, TDS/TCS, PCI SAQ
Phase 2 (3–4 weeks): P1 fixes (RBAC matrix, WAF, Sentry, data retention, load test baselines)
Phase 3 (post-launch): Cross-region replication, chaos engineering, API-key rate limiting

Go-Live Sign-Off Checklist​

Before launch, sign off on:

  • GSTR export tested (3 properties, no discrepancies)
  • E-Invoice NIC integration live in staging (10 test IRNs, QR verified)
  • C-Form export working (5 foreigner registrations tested)
  • PCI SAQ D approved by 3rd-party assessor
  • TDS/TCS calculations correct (3 corporate + 3 luxury test bookings)
  • Children's consent flow working (parent email confirmed)
  • Data retention cron scheduled and tested
  • Load test P95 under SLA; 500 concurrent users sustained
  • WAF deployed to production ALB
  • Backup restore test passed; RTO/RPO confirmed

Signed by: Legal, Finance, Security Officer, Compliance Officer, Operations, Platform Lead

Audit completed: 2026-04-25 by Platform Security Team Next review: 2026-05-25 (post-Phase-1 remediation)