Honest table of our current status across 9frameworks. We never claim a certification we don’t hold. "In progress" means there’s a real audit window. "Attestable" means we follow the controls but there’s no formal certification we can hand you a PDF for.
Audit window Q4 2026. Working with Vanta on evidence collection, change control, vendor risk, and incident response.
DPA template available with the sub-processor list embedded inline. Standard Contractual Clauses (Module 2) for EEA transfers. A standalone sub-processor page and EU-only data residency are both on the roadmap.
Data Processing Agreement →Encryption in transit (TLS 1.2+) + at rest (Supabase). Audit log with actor_is_agent. EU/US data segregation. BAA template draft is in progress; a HIPAA-friendly mode + BAA-signing path will ship with the Enterprise tier (which is planned). HIPAA has no formal certification, only attestation.
Right to know, right to delete, right to opt out of sale (we never sell). 12-month look-back honored. DSAR workflow in /admin per user.
Privacy policy →Following ISO 27001 controls as part of SOC 2 prep — same evidence collection and process work covers both. Formal ISO certification will follow SOC 2 if Enterprise demand justifies the audit cost.
Working through the EU AI Act readiness checklist: per-use-case risk classification (drafting), Article 14 human-oversight assertions for high-risk paths (drafting), transparency disclosures to data subjects when factory output is user-facing (planned). No code in lib/factory/ implements EU AI Act controls yet.
We do not process, store, or transmit card data. Stripe handles all payment processing — Stripe is PCI-DSS Level 1 certified. If your generated app processes cards, you inherit that responsibility.
We have no FedRAMP authorization. We do not currently serve US federal customers. If you have a USG mandate, talk to us — we can scope a private deployment but cannot offer FedRAMP-certified shared infrastructure.
GOVERN / MAP / MEASURE / MANAGE practices documented internally. Bias and fairness monitors live for code-generation paths. Hash-chained audit log records model + prompt + output per build.
Security posture →Email [email protected] with your questionnaire (CAIQ, SIG, custom). We aim to return within 5 business days. Enterprise prospects can also request our under-NDA SOC 2 progress report.