OPS Roadmap — Professional Operations Setup

Executive Summary

In brief: Prioritised ops checklist from basics to enterprise grade.

Why it matters: Shows done vs. open for budget and risk steering.

Cost: Phase 1 mostly process; later phases may add ~€0–50/month tools.

Status: Partially complete.

Decision needed: Prioritise Phase 1 foundation items

Executive Overview — all summaries for decision-makers.

Prioritized checklist for MQA Group. Status: [ ] open · [~] in progress · [x] done

---

Phase 1 — Foundation (Week 1–2)

Ownership & Access

• [ ] Cloudflare migrate to MQA organization account → CLOUDFLARE-MIGRATION
• [x] Render in MQA Team account
• [x] GitHub under MQA-Group (private)
• [ ] GitHub Branch Protection on main + develop: PR required, CI Success, 1 review (requires GitHub Pro/Team for private repos)
• [ ] At least 2 admin accounts per platform (Render, Cloudflare, Azure)

CI/CD

• [x] GitHub Actions CI (Build Frontend + Backend, gate job CI Success)
• [x] PR/Issue templates, Dependabot, CODEOWNERS → GITHUB-FLOW
• [ ] Merge Dependabot PRs regularly (prioritize security patches)
• [ ] Render Preview Deploys optional for PRs

Staging

• [ ] Deploy staging services (render-staging.yaml) → STAGING-SETUP
• [x] DNS: staging.portal.mqa.group, staging.api.mqa.group
• [ ] Separate Azure AD App Registration for staging
• [ ] Staging DB: dedicated Render Postgres (no prod snapshot without anonymization)

Backup

• [x] Restore script + runbook documented
• [x] Backup script (backend/scripts/backup-production-db.sh)
• [ ] Monthly pg_dump → Cloudflare R2 (Cron on Render or GitHub Action)
• [ ] Quarterly restore test (calendar appointment)

Security (immediate)

• [x] CORS for portal.mqa.group
• [x] Auto-seed on deploy disabled
• [x] Open APIs secured (Email, PDF, AI, Analytics reads)
• [x] /uploads auth-protected
• [x] CRON fail-closed
• [x] Mock login blocked in production
• [ ] Postgres IP allowlist restricted (not 0.0.0.0/0)
• [ ] Secret rotation after Cloudflare migration (R2 keys, JWT optional)

---

Phase 2 — Hardening (Week 3–6)

Application Security

• [x] HTML sanitization (DOMPurify) for email/policy views
• [x] Security headers on frontend (serve.json)
• [x] Authenticated PDF downloads (fetch + Blob)
• [ ] Evaluate HttpOnly cookie auth (remove JWT from sessionStorage)
• [ ] IDOR fixes: Policies, Media, Project Inquiries, Risks
• [ ] Uploads fully on R2 (no local /uploads on Render)

Monitoring

• [ ] Uptime monitoring (Better Stack / UptimeRobot) → MONITORING
• [ ] Sentry (Backend + Frontend)
• [ ] Render alert on deploy failure + 5xx spike

Compliance (GDPR / NGO)

• [ ] Processing register: reference portal data flows
• [ ] Incident response plan (72h notification deadline)
• [ ] Define audit log retention policy
• [ ] External pentest (optional, recommended before donor data goes live)

---

Phase 3 — Enterprise (optional)

• [ ] Status page (status.mqa.group)
• [ ] Offsite backup independent of Render
• [ ] Postgres RLS for defense-in-depth
• [ ] WAF rules (Cloudflare Pro)
• [ ] SOC2/ISO documentation linked to portal

---

Responsibilities (proposal)

Area	Role
Render deploy / env	Lead Developer
Cloudflare DNS + R2	MQA IT + Developer
Azure AD / OAuth	MQA IT
Backup tests	Dev + Compliance
Security reviews	Dev (quarterly)

---

Change History

Date	Change
2026-08-03	GitHub Flow: CI gate, PR/Issue templates, Dependabot, GITHUB-FLOW.md
2026-08-03	Initial roadmap, Phase 1 security fixes, CI, documentation set