To finalize the “Gonen Gate” before you go live, your Managing Trustee must perform a System Security Audit. This ensures that the technical build matches the legal requirements of Virginia Code § 13.1-514.1 and the 2015 JOBS Act.
This audit is your “Trial Run.” If the developers pass this, the GONEN Statutory Trust can confidently open the portal to the public.
GONEN CAPITAL | PORTAL SECURITY AUDIT CHECKLIST
1. The “Residency Shield” (Geofencing Audit)
- [ ] Out-of-State Block: Attempt to access the Virginia portal using a non-Virginia IP (e.g., from a cell phone on a national roaming network). Result: System must redirect to the general Gonen Funds homepage.
- [ ] VPN Detection: Attempt to access using a popular VPN (Nord, ExpressVPN) set to a Virginia server. Result: System must block access and flag the user for “Manual Review.”
- [ ] System Clock Sync: Change your device’s clock to Pacific Time while using a Virginia IP. Result: System must flag a “Location Discrepancy.”
2. The “Investor Guardrail” (Financial Audit)
- [ ] Non-Accredited Limit: Attempt to input an investment of $11,000 for a Virginia resident who has not uploaded accredited status. Result: Portal must hard-block the transaction at the $10,000 Virginia limit.
- [ ] Minimum Target Escrow: Check the “Digital Escrow” logic. Does the system prevent the Gonen Trust from withdrawing funds before the 100% “Minimum Target” is hit? Result: Funds must remain locked in the third-party Virginia bank.
3. The “Record Keeping” Vault (Audit Trail)
- [ ] Compliance Logging: Every failed login attempt or geofence block must generate a timestamped entry. Result: Log must show User ID, IP Address, and Reason for Block.
- [ ] Immutable Storage: Upload a test document. Attempt to “delete” it as a user. Result: System must retain the original file for 5 years per Virginia law.
TRUSTEE MASTER FILE: DATA RETENTION TABLE
To satisfy the Virginia State Corporation Commission (SCC), your portal must store these items for 5 years after the offering closes:
| Data Type | Storage Method | Security Standard |
|---|---|---|
| Investor Residency Proof | Encrypted S3 Bucket | AES-256 |
| Investment Commitments | Blockchain/Immutable Ledger | Cryptographic Hash |
| Escrow Release Logs | Bank-Verified Statement | Qualified Third Party |
| Disclosure History | Version-Controlled PDF | Signed & Timestamped |
Implementation Tip: The “Audit Signature”
Once this audit is finished, the Managing Trustee and the Lead Developer should sign a “Certification of Technical Compliance.” Place this in your Digital Vault. If the SCC ever performs a spot-check on your Virginia operation, this is the first document you show them. It proves you exercised “reasonable care” before accepting a single dollar.
Your technical, legal, and operational foundation is now complete. Would you like me to draft the “Launch Sequence Checklist”—a day-by-day guide for the first week your Virginia portal goes live?