PUBLIC WEBSITE

Assurance & ISMS

Assurance Center

Our information-security management posture and assurance programme. ReguShield AI is not yet ISO/IEC 27001 or SOC 2 certified. Both are planned, with no certification date committed. No external penetration test has been completed yet.

Not certified

ISO 27001

4/7

Control families in place

Pentests completed

Open risks

ISMS

ISMS Dashboard

The ReguShield AI platform, its cloud infrastructure (EU data storage, EU application compute, global edge routing) and supporting processes.

Policies

Control themes

Not measured

Annex A coverage

Planned

Status

Program

ISO/IEC 27001 Program

ReguShield AI is NOT yet ISO/IEC 27001 certified. An ISMS programme is planned; no certification date is committed and Annex A coverage has not been formally measured.

A.5 · Organisational controls

Planned

Policies, roles, supplier and incident management to be formalised.

A.6 · People controls

Planned

Screening, awareness and responsibilities.

A.7 · Physical controls

Available

Managed cloud — physical security is inherited from the infrastructure providers.

A.8 · Technological controls

Available

Encryption, access control, RLS isolation, logging, secrets management.

Assurance

SOC 2 Roadmap

Not certified. No SOC 2 report exists; SOC 2 is planned and no report or certification date is committed.

Trust services criteria in scope: Security · Availability · Confidentiality

1. Scoping & readiness assessmentPlanned

2. Control implementation & evidencePlanned

3. Type I observationPlanned

4. Type II observation windowPlanned

Library

Control Library

Access Control

Available

• Role-based access control
• Least privilege
• Tenant isolation (RLS)
• Session management

Cryptography

Available

• TLS 1.3 in transit
• AES-256 at rest
• Server-side secrets

Logging & Monitoring

Available

• Append-only audit trails
• Acceptance audit (immutable)
• Admin action log

Operations Security

Planned

• Managed backups
• Change management
• Vulnerability disclosure

Supplier Security

Planned

• Sub-processor register
• DPA flow-down
• Periodic review

Incident Management

Available

• Detection & triage
• Customer notification
• Coordinated disclosure

Business Continuity

Planned

• Managed backups
• Formal BCP/DR (RTO/RPO)

Testing

Penetration-Test Registry

Scope	Provider	Window	Status	Result
External application & API penetration test	Independent (not yet appointed)	Not scheduled	Planned	Not yet completed
Continuous dependency & SCA scanning	Automated	Ongoing	Available	Monitored

ScopeExternal application & API penetration test

ProviderIndependent (not yet appointed)

WindowNot scheduled

StatusPlanned

ResultNot yet completed

ScopeContinuous dependency & SCA scanning

ProviderAutomated

WindowOngoing

StatusAvailable

ResultMonitored

Vendors

Supplier Reviews

Supplier	Purpose	Location	Review	Status
Supabase	Managed PostgreSQL database, authentication and file storage	EU — Frankfurt, Germany (eu-central-1)	Annual due-diligence review	Planned
Vercel	Application compute and edge delivery	Functions: EU — Frankfurt, Germany · Edge: global network	Annual due-diligence review	Planned
Resend	Transactional email delivery	EU / US	Annual due-diligence review	Planned
OpenAI	AI reasoning for compliance decision-support	US (outside the EEA)	Annual due-diligence review	Planned

SupplierSupabase

PurposeManaged PostgreSQL database, authentication and file storage

LocationEU — Frankfurt, Germany (eu-central-1)

ReviewAnnual due-diligence review

StatusPlanned

SupplierVercel

PurposeApplication compute and edge delivery

LocationFunctions: EU — Frankfurt, Germany · Edge: global network

ReviewAnnual due-diligence review

StatusPlanned

SupplierResend

PurposeTransactional email delivery

LocationEU / US

ReviewAnnual due-diligence review

StatusPlanned

SupplierOpenAI

PurposeAI reasoning for compliance decision-support

LocationUS (outside the EEA)

ReviewAnnual due-diligence review

StatusPlanned

Risk

Risk Register

No third-party security certification yet (ISO 27001 / SOC 2)

Open

Impact Medium (procurement gating) · Transparent disclosure; ISMS programme + external pentest planned; DPA + technical measures available now.

AI sub-processor processes data in the US (OpenAI)

Mitigated

Impact Medium · EU Standard Contractual Clauses + supplementary measures; no model training on customer data; EU-inference option under evaluation.

Sub-processor concentration (managed cloud)

Monitored

Impact Medium · Named register, due-diligence review, exit-readiness documentation (DORA-aligned, planned).

Formal BCP/DR not yet documented with tested RTO/RPO

Open

Impact Medium · Managed backups in place today; formal BCP/DR planned.

Legal documents pending qualified-counsel sign-off

Open

Impact Low/Medium · Framework content published transparently; counsel review before external binding.

Calendar

Audit Calendar

Activity	Type	Status	Window
External penetration test	Security assessment	Planned	Not scheduled
ISMS gap assessment (ISO 27001)	Assurance	Planned	TBC
Sub-processor due-diligence review	Vendor risk	Planned	Annual
Policy & DPA review	Legal/governance	Planned	Annual / on change
Access & RLS control review	Security	Planned	Periodic

ActivityExternal penetration test

TypeSecurity assessment

StatusPlanned

WindowNot scheduled

ActivityISMS gap assessment (ISO 27001)

TypeAssurance

StatusPlanned

WindowTBC

ActivitySub-processor due-diligence review

TypeVendor risk

StatusPlanned

WindowAnnual

ActivityPolicy & DPA review

TypeLegal/governance

StatusPlanned

WindowAnnual / on change

ActivityAccess & RLS control review

TypeSecurity

StatusPlanned

WindowPeriodic

Forward

Security Roadmap

EU data storage & EU application compute; tenant isolation (RLS) · LiveAvailable

GDPR DPA, sub-processor register, data-subject rights · LiveAvailable

Immutable acceptance audit & policy versioning · LiveAvailable

External penetration test · Not yet completed · no date committedPlanned

DORA ICT risk mapping · No date committedPlanned

EU AI Act classification / FRIA scaffolding · No date committedPlanned

ISO/IEC 27001 (ISMS) certification · Not yet certifiedPlanned

ISO/IEC 27701 (privacy) certification · Not yet certifiedPlanned

SOC 2 (Type I → II) · Not yet certifiedPlanned

Qualified e-signature (eIDAS 2) on agreements · FuturePlanned

ReguShield AI · pre-incorporation (planned entity: ReguShield AI Technology UAB, Republic of Lithuania — not yet incorporated). Not ISO 27001 / 27701 / SOC 2 certified — planned, with no certification date committed. See also: Procurement Center · Identity & Access.