Compliance

Where we stand on certifications and independent testing, stated plainly. We do not claim a certification until the certificate exists.

Last updated: 2026-09-18.

Certifications

Certification	Status	What we will publish
ISO/IEC 27001 (Information Security)	In progress	Certificate and Statement of Applicability
ISO 9001 (Quality Management)	In progress	Certificate
SOC 2 Type II	In progress	Report, under NDA

Independent security testing

Activity	Cadence	Status
External penetration test by an independent firm	Annual	First engagement scheduled for Q4 2026; attestation letter available under NDA afterwards
Internal penetration test (OWASP Web Security Testing Guide)	Quarterly	Running; findings tracked to closure against fixed deadlines (Critical 7 days, High 30 days, Medium 90 days)
Automated dependency, container and static-analysis scanning	Every pull request	Running; blocks merge on findings
Cross-tenant and authorisation regression suite	Every build	Running

Details of the programme are on the Security Overview.

Data protection

We operate under the EU GDPR as a Cyprus company and align to the UK GDPR, the Australian Privacy Act and US state privacy laws as described on the Privacy page. Our Data Processing Agreement is pre-signed and applies to every customer automatically.

Documents available on request

Under NDA, from security@docaifabric.com:

• Completed security questionnaires (SIG Lite, CAIQ, or your own)
• Penetration-test attestation letter (after the first external engagement)
• Architecture whitepaper
• Recovery-test attestation (Enterprise plans, once per contract year, as the Service Level Agreement provides)
• Insurance certificates

Public, on this site: Data Handling, Sub-processors, Security Overview, Responsible Disclosure, Data Processing Agreement, Service Level Agreement, Support Policy, Third-Party Notices.