Every framework with its current status, evidence path, and (where applicable) committed target date. The honest version — not a marketing roadmap dressed up as completed work.
Last reviewed:
Art. 6, 17, 20, 28, 32 — lawful basis, erasure, portability, processors, security of processing
DPA available under /dpa; data export covers 30+ tables (lib/gdpr/*); deletion flows wired to app/api/gdpr/* with tombstone records; immutable audit trail (audit_log + hash chain, migration 20260623).
Information Security Management System
Annex A controls inventory in progress; documentation gap analysis completed 2026-Q1. External certification not yet contracted.
Security, Availability, Confidentiality TSCs
Controls implemented and observable in code (RBAC: lib/auth/rbac.ts, audit chain: lib/audit/log.ts, encryption: lib/integrations/oauth/crypto.ts). Observation window for Type I report begins 2026-08-01; auditor engagement signed.
Cloud Computing Compliance Criteria Catalogue
Mapped to ISO 27001 controls; type-2 attestation depends on completed 27001 audit (preceding line). Not yet contracted with a BSI-listed auditor.
Information Security Assessment for automotive sector
No automotive supply-chain customers currently. Will revisit if vertical demand emerges.
Protected Health Information processing
Orconic is not a Business Associate today. Service is not marketed for PHI workloads.
Need a signed copy of any report, DPA, or vendor questionnaire? security@codaiq.com.