ISO/IEC 27001:2022
Not startedNo attestation recorded for this tenant yet.
Trust center
demo-co · estate unconnected · updated 2026-10-16
Serving on demo-co.oddlytrust.com while trust.demo-co.example finishes provisioning (verification: pending; certificate: pending_validation).
No evidence source is connected for this tenant yet. Posture is honest-null (unevidenced), not compliant.
Certifications
SOC 2 (Trust Services Criteria)
Not startedNo attestation recorded for this tenant yet.
Security posture
| Framework | Posture | Coverage | |
|---|---|---|---|
| ISO/IEC 27001:2022 Annex A | 0% | 0/93 evidenced (0%) | |
| SOC 2 Trust Services Criteria (2017 with 2022 points of focus) | 0% | 0/61 evidenced (0%) |
Live receipts
Every control carries the date its evidence was last read, not a badge a document asserts. Evidence older than its window reads Stale.
0 verified · 0 stale · 0 diverged · 0 unknown · 154 not covered
| Control | State | Freshness | Source |
|---|---|---|---|
| No control carries live evidence yet. Every control is published as a gap, not asserted. | |||
154 control(s) have no evidence source connected. They are published as gaps, not hidden.
Sub-processors
Every sub-processor across all products. Sub-processors are scoped per product: a customer viewing this page through their own engagement sees only the ones that process their data.
| Sub-processor | Products | Jurisdiction | Data and DPA | Clauses and provenance |
|---|---|---|---|---|
| Northwind Mail (fictional) Transactional email delivery for the demo tenant. |
All products | Ireland (EU) European Union |
contact-email DPA signed |
iso27001-2022 A.5.19 iso27001-2022 A.5.20 iso27001-2022 A.5.21 soc2-tsc CC9.2 iso42001-2023 A.10.3 Derived from observed egress (outbound SMTP egress), last seen 2026-08-10. |
| Cascade Analytics (fictional) Product usage analytics for the bookkeeping product. |
demo-co:product:ledger | Germany (EU) European Union |
usage-events, account-records DPA signed |
iso27001-2022 A.5.19 iso27001-2022 A.5.20 iso27001-2022 A.5.21 soc2-tsc CC9.2 iso42001-2023 A.10.3 Derived from observed egress (product-truth egress plane), last seen 2026-08-11. |
| Sentinel Biometrics (fictional) Document and liveness checks for the identity-verification product. |
demo-co:product:verify | United Kingdom United Kingdom |
biometric-template, identity-document DPA signed |
iso27001-2022 A.5.19 iso27001-2022 A.5.22 soc2-tsc CC9.2 soc2-tsc P6.4 Declared in the sub-processor register (marketplace partner agreement). |
Sub-processor changes
| Date | Change | Detail |
|---|---|---|
| 2026-08-12 | Added | Sentinel Biometrics (fictional) was added as a sub-processor for demo-co:product:verify, processing biometric-template, identity-document. GDPR Art 28(2): the controller is informed of the intended change and may object. Objection window closes 2026-09-11. |
| 2026-05-20 | Added | Cascade Analytics (fictional) was added as a sub-processor for demo-co:product:ledger, processing usage-events, account-records. GDPR Art 28(2): the controller is informed of the intended change and may object. Objection window closes 2026-06-19. |
| 2026-05-04 | Added | Northwind Mail (fictional) was added as a sub-processor for every product, processing contact-email. GDPR Art 28(2): the controller is informed of the intended change and may object. Objection window closes 2026-06-03. |
Under NDA
The detailed control ledger and evidence pack are available under NDA. Request access with a verified email; access is granted by approval and expires automatically.
Granted access expires 14 days after it is issued.
Request detailed accessAgent authority
Which agents may decide what, on what evidence, granted by whom, and what revokes it. Generated from the register the running code consults.
View the authority tablePosture is scored by one fixed rule from the evidence on file. No estimate, no default-green.
Powered by oddly