This page describes source-level readiness, not a certification or legal opinion. Operational controls, contracts and live deployment settings must be verified separately during diligence.
Last reviewed:
Art. 6, 17, 20, 28, 32 — lawful basis, erasure, portability, processors, security of processing
Source evidence includes DPA/DPIA templates, export and erasure flows, RLS policies, and a hash-chained audit trail. This is not a legal attestation; each live deployment requires a records, contracts, and configuration review.
Information Security Management System
An Annex A control inventory and policy templates exist in source. No certification, signed assessor engagement, or completed operational evidence set is evidenced by this repository.
Security, Availability, Confidentiality TSCs
Selected security controls are observable in source, including RBAC, RLS, audit chaining, and secret encryption. No SOC report, observation window, or signed auditor engagement is evidenced by this repository.
Cloud Computing Compliance Criteria Catalogue
Mapped to ISO 27001 controls; type-2 attestation depends on completed 27001 audit (preceding line). Not yet contracted with a BSI-listed auditor.
Information Security Assessment for automotive sector
No automotive supply-chain customers currently. Will revisit if vertical demand emerges.
Protected Health Information processing
Orconic is not a Business Associate today. Service is not marketed for PHI workloads.
Need a signed copy of any report, DPA, or vendor questionnaire? security@codaiq.com.