Skip to main content

EP-017: Compliance, Audit & Security

Business Objective​

Hotels in India operate under a complex regulatory landscape spanning GST (Goods and Services Tax with slab rates based on room tariff), FSSAI (food safety for F&B operations), GDPR (for international guests from EU), India's DPDP Act 2023 (Digital Personal Data Protection), PCI DSS (payment card handling), and CERT-In mandatory breach notification (6-hour reporting window). Non-compliance carries severe penalties: GST non-compliance can attract 100% penalty on tax evaded; FSSAI violations can result in license cancellation and closure of F&B outlets; CERT-In breach notification failure carries imprisonment up to 3 years. This epic ensures HMP provides automated compliance tooling, tamper-evident audit trails, and data governance capabilities so that hotels can demonstrate compliance during audits without relying on manual record-keeping.

Audience​

  • Primary: Accounts Manager (GST), Compliance Officer, General Manager
  • Secondary: IT Administrator (security, PCI), Admin (audit logs), Front Desk Agent (C-Form, police reporting)
  • Tertiary: External auditors (SOC 2, ISO 27001), Government inspectors

Scope​

In Scope​

  • GST Compliance: Tax calculation with slab rates (0% for tariff <= INR 1,000; 5% for INR 1,001-7,500; 12% for INR 7,501-12,000 per night; 18% for > INR 12,000), HSN codes, e-invoice generation (covered in EP-015), GSTR-1 monthly filing format, GSTR-3B summary filing format
  • FSSAI Compliance: F&B license tracking per outlet, food safety checklist automation, expiry alerting
  • GDPR: Right to erasure (Art. 17), data portability (Art. 20), consent tracking, PII scrubbing, data retention policies
  • DPDP Act 2023: Data principal rights (access, correction, erasure, nomination), consent management, data fiduciary obligations, grievance redressal
  • PCI DSS 4.0: SAQ-A compliance for payment redirection model, no card data storage, secure transmission
  • ISO 27001 / SOC 2 Type II: Preparation documentation, control evidence collection
  • CERT-In Breach Notification: 6-hour incident reporting, breach detection, notification workflow
  • Audit Logging: Tamper-evident hash chain for all data modifications, audit log retention, integrity verification
  • C-Form: Foreign guest registration with police/FRRO (Foreigners Regional Registration Office)
  • Police Form C: Digitized submission for foreign nationals staying at the property
  • Data Retention: Configurable retention periods per data type, automated deletion/anonymization
  • Penetration Testing: Scheduled security assessment support
  • Security Incident Response: Documented response plan with workflow automation

Out of Scope​

  • Legal advice or interpretation of regulations (HMP provides tooling, not legal counsel)
  • Actual filing of GST returns with government portals (HMP generates the data in filing format)
  • Physical security (CCTV, access cards for staff areas)
  • Employee background verification

Current Implementation Status​

Backend​

  • GDPR: GdprService in guest-service with data export and erasure endpoints. GdprController exposes Art. 17 erasure and Art. 20 portability. DataRetentionService with configurable retention rules and spec tests.
  • DPDP Act: DpdpService in guest-service handling data principal requests (ACCESS, CORRECTION, ERASURE, NOMINATION). In-memory store -- needs database persistence. Uses GdprService for actual erasure execution.
  • GST: Gstr3bExportService in analytics-service generates GSTR-3B reports with tax buckets (5%, 12%, 18%, 28%), outward/inward supplies, ITC availed, net tax payable. Property GSTIN stored in schema. GST slab calculation in frontdesk-service e-invoice module.
  • Audit Logging: AuditIntegrityService in @hmp-backend/common lib with SHA-256 hash chain computation and chain verification. AuditLog Prisma model with tenant, property, user, table, record, action, old/new values, IP, user agent. AuditVerifyController and AuditVerifyService in analytics-service.
  • Breach Notification: BreachNotificationController and BreachNotificationService in analytics-service. CertInReporter referenced in common lib.
  • Consent: ConsentController in guest-service for managing guest consent records.
  • SEA Compliance: SeaComplianceService in integration-service for Southeast Asian regulatory requirements.

Dashboard​

  • Audit log views in analytics dashboards
  • GST reports accessible via reports module
  • GDPR data subject request handling in guest management

Compliance Documentation​

  • 09-hmp-compliance directory contains 45+ compliance documents covering GDPR, PCI DSS, SOC 2, ISO 27001, DPDP Act, CERT-In procedures

Gap Analysis​

AreaCurrent StateGapImpact
GST Slab CalculationSlab rates coded in analytics + frontdeskE-invoice generation not connected to NIC portal (see EP-015-004); GSTR-1 detailed filing format not validated against GST portal schemaMonthly GST filing requires manual data extraction
GSTR-3BReport generation service existsOutput not validated against official JSON schema; no support for amendments or previous period correctionsRisk of filing rejection; manual corrections needed
FSSAIDocumentation onlyNo checklist automation; no in-app license tracking; no inspection schedulingFSSAI compliance is entirely manual
GDPR ErasureService existsNo cascading deletion across all services (spa, POS, analytics have guest references); no anonymization alternative to hard deleteIncomplete erasure violates Art. 17
DPDP ActService exists with in-memory storeNot persisted to database; no 72-hour SLA tracking for request fulfillment; no Consent Manager portal for guestsCannot demonstrate DPDP compliance in audit
PCI DSSRazorpay handles card dataSAQ-A self-assessment not completed; no evidence of annual penetration test; no documented cardholder data flowPCI compliance gap if card data touches HMP servers
Audit Log IntegrityHash chain service existsChain verification not scheduled; no alerting on chain break; no export for auditors in standard formatTamper detection is reactive, not proactive
C-Form / Police Form CNot implementedNo form generation from guest identity data; no submission to FRRO/police portalFront desk manually fills paper forms for foreign guests
Data RetentionDataRetentionService existsAuto-deletion job not scheduled; no per-data-type configuration UI; no retention reportOld PII data accumulates indefinitely violating GDPR/DPDP
CERT-In 6-Hour ReportingBreachNotificationService existsNo automated detection triggers; no pre-filled CERT-In incident report template; no countdown timerRisk of missing 6-hour reporting window
SOC 2 / ISO 27001Documentation existsNo automated evidence collection; no control mapping dashboardAudit preparation requires weeks of manual evidence gathering
Penetration TestingNot scheduledNo integration with security scanning tools; no remediation trackingSecurity vulnerabilities may go undetected

User Stories​

Story IDTitlePriorityPointsStatusSprint
US-017-001GST Slab-Based Tax Calculation EngineP05Built3
US-017-002GSTR-1 Monthly Filing Data ExportP08Partial8
US-017-003GSTR-3B Summary Filing ReportP05Built7
US-017-004GDPR Right to Erasure (Art. 17)P08Partial6
US-017-005GDPR Data Portability Export (Art. 20)P15Built6
US-017-006DPDP Act Data Principal Request ManagementP08Partial8
US-017-007Audit Log Hash Chain & Integrity VerificationP08Partial4
US-017-008CERT-In 6-Hour Breach Notification WorkflowP08Partial9
US-017-009C-Form & Police Form C for Foreign GuestsP18Not Started10
US-017-010Data Retention Auto-Deletion & AnonymizationP18Not Started10
US-017-011PCI DSS 4.0 SAQ-A Compliance ChecklistP15Not Started11
US-017-012FSSAI Compliance Checklist AutomationP25Not Started12
US-017-013SOC 2 / ISO 27001 Evidence Collection DashboardP28Not Started14
US-017-014Security Incident Response WorkflowP15Not Started11

Dependencies​

  • EP-001 (Auth & Access): Audit logging depends on user identity from JWT tokens
  • EP-004 (Front Desk & Folio): GST calculation applies to folio charges; C-Form requires guest identity data
  • EP-006 (Guest Management): GDPR erasure and DPDP requests operate on guest data
  • EP-015 (Integrations): GST e-invoice API (NIC portal) is a dependency for US-017-001
  • EP-019 (Platform Admin): Data retention policies may be configured at tenant level

Acceptance Criteria (Epic Level)​

  • GST is calculated correctly using slab rates based on per-night room tariff
  • GSTR-3B report matches manual calculation within INR 1 tolerance
  • GDPR erasure removes or anonymizes guest PII across all services within 72 hours
  • DPDP Act requests are tracked with SLA and completion status
  • Audit log hash chain passes integrity verification with zero breaks for the past 12 months
  • CERT-In breach notification workflow completes pre-filled report within 30 minutes of detection
  • C-Form is auto-generated for foreign guests with data from passport scan
  • Data retention auto-deletion runs on schedule without manual intervention
  • PCI DSS SAQ-A self-assessment passes with zero critical findings

KPIs / Success Metrics​

  • GST calculation accuracy: 100% (zero tax notice risk)
  • GSTR filing rejection rate: 0%
  • GDPR erasure completion within SLA (72 hours): 100%
  • Audit log integrity: zero chain breaks per quarter
  • CERT-In notification time: < 6 hours from detection to submission
  • C-Form auto-generation rate: > 95% of foreign guest check-ins
  • Data retention compliance: zero records past retention period
  • PCI DSS SAQ-A: zero critical findings

Detailed User Stories​

US-017-001: GST Slab-Based Tax Calculation Engine​

As an Accounts Manager, I want to have GST automatically calculated based on room tariff slabs, So that every invoice has the correct tax rate applied per government rules. Priority: P0 | Points: 5 | Sprint: 3 | Status: Built

Implementation Status​

GST slab logic implemented in frontdesk-service for folio charges and analytics-service for reporting. Slabs: 0% (tariff <= INR 1,000), 5% (INR 1,001-7,500), 12% (INR 7,501-12,000 per night -- effective rate post-2024 revision), 18% (> INR 12,000). CGST/SGST split for intra-state; IGST for inter-state. Property GSTIN and state code stored in schema.

Acceptance Criteria​

Scenario: Room tariff INR 5,000 per night applies 12% GST
  Given a room is booked at INR 5,000 per night (base tariff)
  And the property is in Maharashtra (state code 27) and the guest billing address is Maharashtra
  When the room charge is posted to the folio
  Then GST is calculated as 12% of INR 5,000 = INR 600
  And it is split as CGST INR 300 + SGST INR 300 (intra-state)
  And the folio transaction shows amount INR 5,000 with taxAmount INR 600

Scenario: Room tariff INR 15,000 per night applies 18% GST
  Given a room is booked at INR 15,000 per night
  And the guest billing address is in Karnataka (inter-state from Maharashtra property)
  When the room charge is posted
  Then GST is calculated as 18% of INR 15,000 = INR 2,700
  And it is charged as IGST INR 2,700 (inter-state)
  And the invoice clearly shows IGST instead of CGST+SGST

Scenario: F&B charges apply restaurant GST rate
  Given a restaurant order total is INR 2,000 at an AC restaurant
  When the charge is posted to the guest folio
  Then GST is calculated at 5% (restaurant services without ITC) = INR 100
  And HSN code 996331 (restaurant services) is applied

US-017-002: GSTR-1 Monthly Filing Data Export​

As an Accounts Manager, I want to export monthly GSTR-1 data in the format required by the GST portal, So that I can upload it directly for filing without manual data preparation. Priority: P0 | Points: 8 | Sprint: 8 | Status: Partial

Implementation Status​

GSTR-3B export service exists with tax bucket aggregation. Gap: GSTR-1 requires invoice-level detail (B2B invoices > INR 2.5 lakh, B2C large > INR 2.5 lakh, B2C small, credit/debit notes, HSN summary). The detailed invoice-level export with proper section classification is not built.

Acceptance Criteria​

Scenario: Generate GSTR-1 B2B section for corporate invoices
  Given 15 corporate invoices were raised in March 2026, each > INR 2,50,000
  When the accounts manager generates GSTR-1 for March 2026
  Then the B2B section lists each invoice with:
    | Field        | Description                    |
    | GSTIN        | Customer GSTIN                 |
    | Invoice No   | HMP invoice number             |
    | Invoice Date | Folio settlement date          |
    | Taxable Value| Pre-tax amount                 |
    | Rate         | Applicable GST rate            |
    | IGST/CGST/SGST| Tax amounts per component     |
  And the export is available as JSON (GST portal upload format) and Excel

Scenario: GSTR-1 HSN summary section
  Given the property had the following revenue categories in March 2026:
    | HSN Code | Description        | Taxable Value | Tax Rate |
    | 996311   | Room accommodation | INR 50,00,000 | 12%/18%  |
    | 996331   | Restaurant services| INR 10,00,000 | 5%       |
    | 999722   | Spa services       | INR 3,00,000  | 18%      |
  When GSTR-1 HSN summary is generated
  Then each HSN code shows aggregated taxable value and tax components
  And the total matches the sum of all other GSTR-1 sections

US-017-003: GSTR-3B Summary Filing Report​

As an Accounts Manager, I want to generate a GSTR-3B summary report for the month, So that I can verify tax liability before filing. Priority: P0 | Points: 5 | Sprint: 7 | Status: Built

Implementation Status​

Gstr3bExportService generates full GSTR-3B report with outward supplies, inward supplies, ITC availed, net tax payable, tax by rate (5%, 12%, 18%, 28%), interest calculation for late filing, and GSTIN from property record.

Acceptance Criteria​

Scenario: GSTR-3B report for March 2026
  Given the property had total outward supplies of INR 63,00,000 in March 2026
  When the accounts manager generates GSTR-3B for period "032026"
  Then the report shows:
    | Section              | IGST      | CGST      | SGST      |
    | Outward Supplies     | 1,50,000  | 2,80,000  | 2,80,000  |
    | Inward Supplies (RCM)| 0         | 0         | 0         |
    | ITC Availed          | 20,000    | 40,000    | 40,000    |
    | Net Tax Payable      | 1,30,000  | 2,40,000  | 2,40,000  |
  And the tax-by-rate breakdown shows amounts per slab (5%, 12%, 18%)
  And the report includes property GSTIN, return period, and generation timestamp

Scenario: Late filing interest calculation
  Given GSTR-3B for February 2026 was due on March 20
  And today is March 25 (5 days late)
  When the report is generated
  Then the interest field shows 18% per annum on net tax payable for 5 days
  And a note explains "Interest @ 18% p.a. applicable for late filing"

US-017-004: GDPR Right to Erasure (Art. 17)​

As a Guest (EU citizen), I want to request deletion of all my personal data from HMP, So that my right to be forgotten under GDPR is honored. Priority: P0 | Points: 8 | Sprint: 6 | Status: Partial

Implementation Status​

GdprService in guest-service has erasure endpoint that deletes/anonymizes guest record. GdprController exposes the API. Gap: erasure does not cascade to spa appointments, POS orders (guest name), campaign communications, feedback responses, or analytics aggregations that reference the guest. No verification of identity before erasure. No statutory hold check (e.g., tax records must be retained for 8 years per Indian IT Act).

Acceptance Criteria​

Scenario: EU guest requests data erasure
  Given guest "Hans Mueller" (German national) submits an erasure request
  And his guest profile links to 3 reservations, 2 spa appointments, 5 POS orders, and 1 feedback response
  When the compliance officer approves the erasure request
  Then the guest profile is anonymized: name becomes "REDACTED", email/phone set to null
  And guest identities (passport data) are permanently deleted
  And spa appointments retain financial data but guest name is anonymized
  And POS orders retain amounts but guest references are anonymized
  And the erasure is completed within 72 hours and logged in the GDPR request tracker

Scenario: Erasure blocked by statutory retention
  Given guest "Hans Mueller" has a reservation from January 2026 with GST invoice
  And Indian tax law requires invoice retention for 8 years
  When erasure is requested
  Then the system flags the conflict: "GST invoices from Jan 2026 must be retained until Jan 2034"
  And offers partial erasure: PII is anonymized but financial records and invoice data are preserved
  And the compliance officer is informed of the retention obligation

US-017-005: GDPR Data Portability Export (Art. 20)​

As a Guest (EU citizen), I want to download all my personal data in a machine-readable format, So that I can exercise my right to data portability. Priority: P1 | Points: 5 | Sprint: 6 | Status: Built

Implementation Status​

GdprService has data export functionality that compiles guest profile, preferences, reservations, and communications into a structured format. Controller endpoint available.

Acceptance Criteria​

Scenario: Guest requests data portability export
  Given guest "Hans Mueller" requests a data export via the guest portal
  When the system processes the request
  Then a JSON file is generated containing:
    | Section        | Data                                    |
    | profile        | Name, email, phone, nationality, DOB    |
    | preferences    | Room, food, service preferences          |
    | reservations   | All booking history with dates, amounts  |
    | communications | All emails/SMS sent to the guest         |
    | consent        | Consent records with timestamps          |
  And the file is encrypted and made available for download
  And the download link expires after 72 hours
  And the export event is logged in the audit trail

US-017-006: DPDP Act Data Principal Request Management​

As a Compliance Officer, I want to manage data principal requests under India's DPDP Act 2023, So that the property fulfills its obligations as a data fiduciary within the statutory timeframe. Priority: P0 | Points: 8 | Sprint: 8 | Status: Partial

Implementation Status​

DpdpService handles request types: ACCESS, CORRECTION, ERASURE, NOMINATION. Uses GdprService for actual erasure. Gap: requests stored in-memory (not database persisted); no SLA tracking (DPDP requires response within "reasonable time" -- interpreted as 72 hours); no guest-facing consent manager portal; no nominee management for deceased data principals.

Acceptance Criteria​

Scenario: Indian guest submits data access request
  Given guest "Priya Sharma" (Indian national with Aadhaar) submits a DPDP access request
  When the request is created in the system
  Then a DPDP request record is persisted in the database with:
    | Field       | Value                |
    | requestType | ACCESS               |
    | status      | PENDING              |
    | slaDeadline | Current time + 72h   |
    | guestId     | guest_priya          |
  And the compliance officer receives a notification
  And the SLA countdown timer begins

Scenario: DPDP erasure request with nominee
  Given deceased guest's nominee submits an erasure request with death certificate reference
  When the compliance officer processes the nomination
  Then the nominee's identity is verified against the nomination record
  And the erasure proceeds as per DPDP Act Section 9 (nomination rights)
  And the request is logged with nominee details and verification evidence

Scenario: SLA breach alerting
  Given a DPDP request was created 60 hours ago with status "PENDING"
  When 12 hours remain before the 72-hour SLA deadline
  Then the compliance officer receives an urgent alert: "DPDP request #123 due in 12 hours"
  And the request appears highlighted in red on the compliance dashboard
  And if the SLA expires unfulfilled, it is escalated to the General Manager

US-017-007: Audit Log Hash Chain & Integrity Verification​

As an Auditor, I want to verify that audit logs have not been tampered with, So that the integrity of the audit trail can be trusted during compliance audits. Priority: P0 | Points: 8 | Sprint: 4 | Status: Partial

Implementation Status​

AuditIntegrityService computes SHA-256 hash chain: each entry's hash includes the previous entry's hash, creating a tamper-evident chain. verifyChain() method walks the chain and detects breaks. AuditVerifyController exposes verification endpoint. Gap: verification is on-demand only (not scheduled); no alerting on chain break; no export in standardized audit format (e.g., CADF); entryHash field may not be populated for all existing audit entries.

Acceptance Criteria​

Scenario: Verify audit chain integrity
  Given 50,000 audit log entries exist for tenant "HMP Hotels" in Q4 2025
  When the auditor triggers chain verification via the dashboard
  Then the system walks the chain from genesis to the latest entry
  And verifies each entry's hash = SHA-256(previousHash | tenantId | tableName | recordId | action | createdAt)
  And reports: "Chain verified: 50,000 entries, 0 breaks, verification time: 12 seconds"

Scenario: Detect tampered audit entry
  Given an audit entry was modified directly in the database (bypassing the application)
  When chain verification runs
  Then the system detects the hash mismatch at the tampered entry
  And reports: "Chain BROKEN at entry ID abc123, index 34,567. Expected hash: x, found: y"
  And an alert is sent to the IT Administrator and Compliance Officer
  And the entry is flagged as "INTEGRITY_VIOLATION" in the dashboard

Scenario: Scheduled daily chain verification
  Given the automated verification job is configured to run at 02:00 IST daily
  When the job executes
  Then it verifies the chain for the previous 24 hours of entries
  And stores the verification result (passed/failed, entries checked, time taken)
  And if a break is detected, an immediate alert is raised

US-017-008: CERT-In 6-Hour Breach Notification Workflow​

As an IT Administrator, I want to follow a guided breach notification workflow that helps me report to CERT-In within 6 hours, So that the property complies with India's mandatory cybersecurity incident reporting requirement. Priority: P0 | Points: 8 | Sprint: 9 | Status: Partial

Implementation Status​

BreachNotificationService and BreachNotificationController exist in analytics-service. CertInReporter referenced in common lib. Gap: no automated detection triggers (e.g., mass data export, brute-force pattern, unauthorized admin access); no pre-filled CERT-In incident report template (Form for reporting cyber security incidents); no 6-hour countdown timer; no workflow state machine (Detect -> Assess -> Contain -> Notify -> Remediate).

Acceptance Criteria​

Scenario: Initiate breach notification workflow
  Given the IT administrator detects a potential data breach (unauthorized data export of 500 guest records)
  When they initiate the CERT-In breach notification workflow
  Then a 6-hour countdown timer starts from the detection timestamp
  And the system creates an incident record with severity, affected systems, and estimated impact
  And a pre-filled CERT-In incident report template is generated with:
    | Field                  | Auto-filled Value                        |
    | Organization Name      | Property name from settings              |
    | Date of Incident       | Detection timestamp                      |
    | Type of Incident       | Data Breach                              |
    | Systems Affected       | Guest Management Service                 |
    | Number of Records      | 500                                      |
  And the workflow moves to "ASSESSMENT" stage

Scenario: CERT-In report submission before deadline
  Given a breach notification workflow is in "CONTAINMENT" stage
  And the 6-hour deadline is in 2 hours
  When the IT administrator completes the incident report and clicks "Submit to CERT-In"
  Then the report is exported in the prescribed format
  And the submission timestamp is recorded
  And the incident record updates to "NOTIFIED" status
  And all involved personnel receive confirmation: "CERT-In notification submitted at [time], within deadline"

Scenario: Deadline approaching alert
  Given a breach notification workflow started 4 hours ago
  When 2 hours remain before the 6-hour CERT-In deadline
  Then the system sends urgent alerts to IT Administrator, General Manager, and Compliance Officer
  And the dashboard shows a prominent red banner: "CERT-In deadline in 2 hours"
  And at 5.5 hours, a final alert: "CERT-In deadline in 30 minutes -- immediate action required"

US-017-009: C-Form & Police Form C for Foreign Guests​

As a Front Desk Agent, I want to auto-generate C-Form (foreigners registration) from the guest's passport data captured at check-in, So that I can submit the mandatory police reporting for foreign nationals without manual form-filling. Priority: P1 | Points: 8 | Sprint: 10 | Status: Not Started

Implementation Status​

Guest identity model stores passport data (IdType.PASSPORT with number, issue/expiry dates, issue country). No C-Form template, no Form C PDF generation, no FRRO portal integration, no batch submission capability.

Acceptance Criteria​

Scenario: Auto-generate Form C for foreign guest at check-in
  Given guest "John Smith" (British passport, number GB123456) checks in to room 301
  And his passport was scanned at check-in capturing: name, nationality, passport number, DOB, visa type, visa number, arrival date in India
  When the front desk agent clicks "Generate Form C"
  Then the system auto-fills Form C with:
    | Field              | Value                    |
    | Name               | JOHN SMITH               |
    | Nationality        | British                  |
    | Passport No        | GB123456                 |
    | Date of Arrival    | 2026-03-08               |
    | Arrived From       | (from reservation data)  |
    | Hotel Name         | Property name            |
    | Room Number        | 301                      |
    | Duration of Stay   | Check-in to checkout     |
  And the form is available as PDF for printing and digital submission
  And the form is stored in the guest's record for audit

Scenario: Batch submit Form C to FRRO portal
  Given 5 foreign guests checked in today
  And all Form C documents are generated
  When the front desk manager clicks "Submit All to FRRO"
  Then the system uploads all 5 forms via the FRRO portal API (when available)
  Or generates a consolidated report for manual submission
  And each form's submission status is tracked (SUBMITTED/PENDING/ACKNOWLEDGED)

US-017-010: Data Retention Auto-Deletion & Anonymization​

As a Compliance Officer, I want to configure data retention periods per data type and have the system automatically delete or anonymize expired data, So that the property complies with GDPR Article 5(1)(e) and DPDP Act storage limitation principle. Priority: P1 | Points: 8 | Sprint: 10 | Status: Not Started

Implementation Status​

DataRetentionService in guest-service exists with spec tests. Configurable retention rules defined. Gap: no scheduled job (cron) to execute retention rules; no UI for configuring retention periods; no per-data-type granularity (e.g., guest PII 3 years, financial records 8 years, audit logs 7 years); no dry-run mode to preview what would be deleted.

Acceptance Criteria​

Scenario: Configure retention periods per data type
  Given the compliance officer navigates to Settings > Data Retention
  When they configure the following retention rules:
    | Data Type            | Retention Period | Action       |
    | Guest PII            | 3 years          | Anonymize    |
    | Financial Records    | 8 years          | Archive      |
    | Audit Logs           | 7 years          | Delete       |
    | Communication Logs   | 2 years          | Delete       |
    | Session Tokens       | 90 days          | Delete       |
  Then the rules are saved and the scheduled job is updated

Scenario: Automatic anonymization of expired guest PII
  Given the retention rule for Guest PII is 3 years with action "Anonymize"
  And guest "Amit Patel" last stayed on 2023-03-01 (3 years ago)
  And he has no future reservations
  When the nightly retention job runs
  Then Amit's profile is anonymized: firstName="REDACTED", lastName="REDACTED", email=null, phone=null
  And his Aadhaar/passport records are permanently deleted
  And financial data (folio amounts, payments) is preserved for tax compliance
  And the retention log records: "Guest guest_amit anonymized per 3-year PII retention rule"

US-017-011: PCI DSS 4.0 SAQ-A Compliance Checklist​

As an IT Administrator, I want to complete a PCI DSS 4.0 SAQ-A self-assessment within HMP, So that I can demonstrate the property does not store, process, or transmit cardholder data. Priority: P1 | Points: 5 | Sprint: 11 | Status: Not Started

Implementation Status​

HMP uses Razorpay's hosted checkout (redirect model) which qualifies for SAQ-A (no card data touches HMP servers). No self-assessment questionnaire, no evidence collection, no annual attestation workflow.

Acceptance Criteria​

Scenario: Complete SAQ-A self-assessment
  Given the IT administrator opens Compliance > PCI DSS > SAQ-A
  Then the system presents the SAQ-A questionnaire with all applicable requirements
  And each question has "Yes", "No", "N/A" options with evidence upload
  When the administrator completes all questions
  Then the system calculates compliance status (Compliant/Non-Compliant)
  And generates a signed PDF attestation with date and assessor name
  And stores the assessment for audit retrieval

Scenario: SAQ-A annual renewal reminder
  Given the last PCI DSS self-assessment was completed on 2025-04-01
  When the current date is 2026-03-01 (30 days before anniversary)
  Then the system sends a reminder: "PCI DSS SAQ-A annual assessment due on 2026-04-01"
  And the compliance dashboard shows "PCI DSS: Renewal Due" in yellow

US-017-012: FSSAI Compliance Checklist Automation​

As a General Manager, I want to maintain digital FSSAI food safety checklists for each F&B outlet, So that inspectors can verify compliance and the property avoids license penalties. Priority: P2 | Points: 5 | Sprint: 12 | Status: Not Started

Implementation Status​

FSSAI compliance documentation exists in 09-hmp-compliance directory. No in-app checklist, no outlet-level license tracking, no inspection scheduling, no photo evidence capture.

Acceptance Criteria​

Scenario: Daily FSSAI food safety checklist
  Given outlet "Spice Garden Restaurant" has a daily food safety checklist configured
  When the F&B manager opens the checklist for today
  Then the checklist includes items:
    | Item                          | Type     |
    | Kitchen temperature log       | Reading  |
    | Food storage temperature      | Reading  |
    | Staff hygiene compliance      | Yes/No   |
    | Pest control status           | Yes/No   |
    | Equipment cleanliness         | Yes/No   |
    | Expired ingredients check     | Yes/No   |
  And the manager can upload photo evidence for each item
  And the completed checklist is stored with timestamp and user

Scenario: FSSAI inspection readiness report
  Given the General Manager needs to prepare for an FSSAI inspection
  When they open Compliance > FSSAI > Inspection Readiness
  Then the report shows license status (valid/expiring/expired) per outlet
  And checklist completion rate for the last 90 days
  And any flagged non-compliance items with dates and resolution status

US-017-013: SOC 2 / ISO 27001 Evidence Collection Dashboard​

As a Compliance Officer, I want to collect and organize evidence for SOC 2 Type II and ISO 27001 audits from HMP, So that audit preparation is automated rather than weeks of manual evidence gathering. Priority: P2 | Points: 8 | Sprint: 14 | Status: Not Started

Implementation Status​

45+ compliance documents exist in 09-hmp-compliance. No automated evidence collection, no control-to-evidence mapping, no audit-ready export.

Acceptance Criteria​

Scenario: SOC 2 evidence collection
  Given the compliance officer opens Compliance > SOC 2 > Evidence Collection
  Then the dashboard shows SOC 2 Trust Service Criteria with evidence mapping:
    | Criteria          | Control                  | Evidence Source          | Status    |
    | CC6.1 Logical Access | RBAC with 9 roles     | Auth service config      | Collected |
    | CC6.2 Authentication | MFA enforcement        | MFA enrollment report    | Collected |
    | CC7.2 Monitoring     | Audit log chain        | Chain verification report| Collected |
    | CC8.1 Change Mgmt   | Git commit history      | GitHub API               | Pending   |
  And each evidence item can be exported as PDF with timestamp and hash
  And the overall readiness percentage is displayed (e.g., 72% complete)

US-017-014: Security Incident Response Workflow​

As an IT Administrator, I want to follow a structured incident response workflow when a security event is detected, So that the team responds consistently and meets regulatory notification requirements. Priority: P1 | Points: 5 | Sprint: 11 | Status: Not Started

Implementation Status​

BreachNotificationService exists but covers only CERT-In notification. No general incident response workflow, no severity classification, no containment checklist, no post-incident review template.

Acceptance Criteria​

Scenario: Security incident workflow stages
  Given a security incident is detected (e.g., brute-force attack on admin accounts)
  When the IT administrator creates an incident in the security dashboard
  Then the workflow progresses through stages:
    | Stage        | Actions                                           |
    | DETECTION    | Log detection details, classify severity (P1-P4)  |
    | ASSESSMENT   | Identify scope, affected systems, data exposure    |
    | CONTAINMENT  | Block IP, disable compromised accounts, isolate    |
    | ERADICATION  | Remove threat, patch vulnerability                 |
    | RECOVERY     | Restore services, verify integrity                 |
    | NOTIFICATION | CERT-In (if applicable), affected users, management|
    | REVIEW       | Root cause analysis, lessons learned, policy update |
  And each stage has a checklist with required/optional items
  And the total incident timeline is tracked for post-incident reporting

Scenario: Automated detection trigger
  Given the system detects 50 failed login attempts from the same IP in 5 minutes
  When the threshold is breached
  Then the system automatically creates a security incident with severity P2
  And blocks the offending IP address
  And notifies the IT administrator via email and dashboard alert
  And the incident record pre-fills detection details from the auth service logs