PUBLIC WEBSITE

Assurance & ISMS

Assurance Center

Our information-security management posture and assurance programme. ReguShield AI is not yet ISO/IEC 27001 or SOC 2 certified — the programmes below track control coverage toward future assurance, transparently.

69%

ISMS coverage

4/7

Control families

Pentests completed

Open risks

ISMS

ISMS Dashboard

The ReguShield AI platform, its EU cloud infrastructure and supporting processes.

Policies

Control themes

69%

Avg coverage

In progress

Status

Program

ISO/IEC 27001 Program

ReguShield AI is NOT yet ISO/IEC 27001 certified. The programme below tracks Annex A control coverage toward a future certification.

A.5 · Organisational controls

Planned

62%

Policies, roles, supplier and incident management being formalised.

A.6 · People controls

Planned

55%

Screening, awareness and responsibilities.

A.7 · Physical controls

Implemented

80%

Managed cloud — physical security inherited from EU providers.

A.8 · Technological controls

Implemented

78%

Encryption, access control, RLS isolation, logging, secrets management.

Roadmap

SOC 2 Roadmap

No SOC 2 report exists yet — Type I is a roadmap item.

Trust services criteria in scope: Security · Availability · Confidentiality

1. Scoping & readiness assessmentRoadmap

2. Control implementation & evidenceRoadmap

3. Type I observationRoadmap

4. Type II observation windowRoadmap

Library

Control Library

Access Control

Implemented

• Role-based access control
• Least privilege
• Tenant isolation (RLS)
• Session management

Cryptography

Implemented

• TLS 1.3 in transit
• AES-256 at rest
• Server-side secrets

Logging & Monitoring

Implemented

• Append-only audit trails
• Acceptance audit (immutable)
• Admin action log

Operations Security

Planned

• Managed backups
• Change management
• Vulnerability disclosure

Supplier Security

Planned

• Sub-processor register
• DPA flow-down
• Periodic review

Incident Management

Implemented

• Detection & triage
• Customer notification
• Coordinated disclosure

Business Continuity

Planned

• Managed backups
• Formal BCP/DR (RTO/RPO)

Testing

Penetration-Test Registry

Scope	Provider	Window	Status	Result
External application & API penetration test	Independent (to be appointed)	Q3 2026	Planned	—
Continuous dependency & SCA scanning	Automated	Ongoing	Implemented	Monitored

ScopeExternal application & API penetration test

ProviderIndependent (to be appointed)

WindowQ3 2026

StatusPlanned

Result—

ScopeContinuous dependency & SCA scanning

ProviderAutomated

WindowOngoing

StatusImplemented

ResultMonitored

Vendors

Supplier Reviews

Supplier	Purpose	Location	Review	Status
Supabase	Managed PostgreSQL database & authentication	EU	Annual due-diligence review	Planned
Vercel	Application hosting & edge delivery	EU / Global edge	Annual due-diligence review	Planned
Resend	Transactional email delivery	EU / US	Annual due-diligence review	Planned
OpenAI	AI reasoning for compliance decision-support	US	Annual due-diligence review	Planned

SupplierSupabase

PurposeManaged PostgreSQL database & authentication

LocationEU

ReviewAnnual due-diligence review

StatusPlanned

SupplierVercel

PurposeApplication hosting & edge delivery

LocationEU / Global edge

ReviewAnnual due-diligence review

StatusPlanned

SupplierResend

PurposeTransactional email delivery

LocationEU / US

ReviewAnnual due-diligence review

StatusPlanned

SupplierOpenAI

PurposeAI reasoning for compliance decision-support

LocationUS

ReviewAnnual due-diligence review

StatusPlanned

Risk

Risk Register

No third-party security certification yet (ISO 27001 / SOC 2)

Open

Impact Medium (procurement gating) · Transparent disclosure; ISMS programme + external pentest planned; DPA + technical measures available now.

AI sub-processor processes data in the US (OpenAI)

Mitigated

Impact Medium · EU Standard Contractual Clauses + supplementary measures; no model training on customer data; EU-inference option under evaluation.

Sub-processor concentration (managed cloud)

Monitored

Impact Medium · Named register, due-diligence review, exit-readiness documentation (DORA-aligned, planned).

Formal BCP/DR not yet documented with tested RTO/RPO

Open

Impact Medium · Managed backups in place today; formal BCP/DR planned.

Legal documents pending qualified-counsel sign-off

Open

Impact Low/Medium · Framework content published transparently; counsel review before external binding.

Calendar

Audit Calendar

Activity	Type	Status	Window
External penetration test	Security assessment	Planned	Q3 2026
ISMS gap assessment (ISO 27001)	Assurance	Roadmap	TBC
Sub-processor due-diligence review	Vendor risk	Planned	Annual
Policy & DPA review	Legal/governance	Planned	Annual / on change
Access & RLS control review	Security	Planned	Periodic

ActivityExternal penetration test

TypeSecurity assessment

StatusPlanned

WindowQ3 2026

ActivityISMS gap assessment (ISO 27001)

TypeAssurance

StatusRoadmap

WindowTBC

ActivitySub-processor due-diligence review

TypeVendor risk

StatusPlanned

WindowAnnual

ActivityPolicy & DPA review

TypeLegal/governance

StatusPlanned

WindowAnnual / on change

ActivityAccess & RLS control review

TypeSecurity

StatusPlanned

WindowPeriodic

Forward

Security Roadmap

EU data residency & tenant isolation (RLS) · LiveImplemented

GDPR DPA, sub-processor register, data-subject rights · LiveImplemented

Immutable acceptance audit & policy versioning · LiveImplemented

External penetration test · Q3 2026Planned

DORA ICT risk mapping · 2026Planned

EU AI Act classification / FRIA scaffolding · 2026Planned

ISO/IEC 27001 (ISMS) certification · Not yet certifiedRoadmap

ISO/IEC 27701 (privacy) certification · Not yet certifiedRoadmap

SOC 2 (Type I → II) · Not yet certifiedRoadmap

Qualified e-signature (eIDAS 2) on agreements · FutureRoadmap

ReguShield AI · pre-incorporation (planned entity: ReguShield AI Technology UAB, Republic of Lithuania — not yet incorporated). Not ISO 27001 / 27701 / SOC 2 certified — programmes in progress, disclosed transparently. See also: Procurement Center · Identity & Access.