Certifications — stated honestly
| Framework | Status | Detail |
|---|---|---|
| SOC 2 Type II | not held | The observation window starts when the first enterprise engagement is real. We will not claim “SOC 2 in progress” as though it were a status; it is a plan. |
| ISO/IEC 27001 | not held | Sequenced after SOC 2. |
| ISO/IEC 42001 | not held | We map evidence to 42001 on standards mapping. That is not the same as being certified to it, and we will not blur the two. |
| CSA STAR Level 1 (CAIQ v4) | planned | Self-assessment, highest compliance return available to a vendor our size. Will be published in full here. |
| Independent penetration test | not yet run | Summary letter will be published here when it exists. |
If a vendor your size claims more than this list, ask to see the report rather than the badge.
Architecture: the short version
In the default evidence mode, no raw query, result row or prompt leaves your boundary. What crosses it is cryptographic hashes, invariant pass/fail status, row counts, latency and a signed manifest. Sanitised diagnostic export and customer-hosted VDI review exist for exception triage and both require your explicit written authorisation. The full data-classification matrix is on security & data handling.
Data handling
Classification matrix, encryption at rest and in transit, key custody, cryptographic erasure.
Subprocessors
Every third party that can touch customer data, with location and purpose.
DPA
Limited processing licence, SCCs with a transfer impact assessment, NIST SP 800-188 risk-tiered disclosure.
Exit & portability
Documented non-proprietary export schema. Run the exit drill before you sign, not after.
Vulnerability disclosure
Scope, safe harbour and acknowledgement time. Machine-readable at security.txt.
Commitments that are contractual, not aspirational
- Recall. A suspected false finding triggers an automated hold within four hours, written notice within 24 business hours and root-cause analysis within five business days. Recall protocol.
- Independence. Fixed fee, no success fee, no hourly billing, and a written list of work we refuse. Independence Charter.
- Scope honesty. Anything we cannot verify is counted as excluded against coverage, never reclassified as a pass. Scope & exclusions.
- Method limits. Published, including the ten failure domains that are not validated. Known limitations.
Status and uptime
A public status page is planned and will be hosted on infrastructure independent of eval.qa — a status page that goes down with the system it reports on is decoration. Until it exists, incidents affecting a live assurance run are communicated directly under the recall protocol.