Trust Centre · Certifications & assurance
Nothing here is certified yet. Here are the dates.
ISO/IEC 27001 and SOC 2 Type II are both in progress. Neither is achieved, and we will not describe them as achieved, imply it with a badge, or say "certification-ready" and hope you read it as certified. This page is the least flattering page on the site and it is deliberately the one we point buyers at first.
Status as at 14 Aug 2026. Updated within five business days of any change to a milestone.
Certification status
| Framework | Status | Where we are | Assessor | Target | Evidence available now |
|---|---|---|---|---|---|
| ISO/IEC 27001:2022 | In progress | ISMS documented and operating; internal audit complete; Stage 1 audit booked for October 2026 | Accredited certification body, engaged | Q1 2027 | Statement of Applicability, internal audit report, under NDA |
| SOC 2 Type II | In progress | Type I readiness assessment complete; 6-month observation window opened 01 Jul 2026 | Independent CPA firm, engaged | Q2 2027 | Readiness assessment summary, under NDA |
| Third-party penetration test | Complete | Annual full-scope test completed May 2026; all high findings remediated and retested | Independent security firm, Singapore | Next: May 2027 | Summary letter, under NDA |
| Release-triggered testing | Operating | Targeted test on any change to the effect compiler, the secrets gateway or the permission model | Independent security firm | Continuous | Cadence attestation, under NDA |
| CAIQ v4 / SIG-lite | Published | Pre-answered and refreshed quarterly, so your questionnaire is mostly answered before you send it | Self-assessment | Refreshed Jul 2026 | Full document, under NDA |
| ISO/IEC 42001 (AI management) | Evaluating | Under assessment as the natural successor once 27001 is certified. No commitment made. | — | Not committed | — |
| MAS certification | Does not exist | MAS does not certify, approve or endorse vendor software. No vendor holds this. See the alignment page for what can honestly be said. | — | n/a | — |
Why we publish it this way
Because the alternative fails at exactly the moment it matters. A badge that turns out to be aspirational is discovered during your audit, not during your procurement — and by then it is your problem as much as ours.
An overstated claim is a contract problem
Certification language ends up in an MSA, a board paper and a regulatory filing. Saying "in progress" today costs a deal occasionally. Saying "certified" today costs a customer permanently.
Controls exist before certificates do
A certificate attests that controls were operating during an observation window. The controls themselves are documented in full on the security page and can be assessed today, certificate or not.
How a vendor handles this predicts everything
This is the cheapest available signal of how a supplier will behave when the next inconvenient fact arrives — during an incident, during an audit, or on the day a model provider changes its terms.
Penetration testing
| Test | Date | Scope | High | Medium | State |
|---|---|---|---|---|---|
| Annual full scope | May 2026 | Platform, API, tenant isolation, secrets gateway | 2 | 7 | Remediated, retested |
| Release-triggered | Mar 2026 | Effect compiler rewrite | 0 | 3 | Remediated |
| Release-triggered | Nov 2025 | Permission model and impersonation flow | 1 | 4 | Remediated, retested |
| Annual full scope | Apr 2025 | Platform and API | 3 | 11 | Remediated, retested |
Vulnerability disclosure
- Contact
[email protected] - Policy
/.well-known/security.txt - Acknowledgement
1 business day - Triage
48 hours - Critical fix target
7 days - High fix target
30 days - Disclosure
Coordinated, agreed with you - Credit
Named, if you want it - Bug bounty
Private programme only
A public bounty programme is deferred until the disclosure process has run a full year without a backlog. Running a bounty you cannot service is worse than not running one.
One more thing we will not do: we do not accept a badge or listing from a trust-marketplace product and present it as an independent assessment. Where an assessment is a self-assessment, this page labels it a self-assessment.
Get the assurance evidence
Statement of Applicability, internal audit summary, penetration-test summary letter, readiness assessment and the pre-answered CAIQ, all under a click-through NDA.
Open the document portalTrack the milestones
Subscribe and we will notify you when a certification milestone moves — including when it slips, which is the notification that actually matters.
Subscribe on the status page