Compliance roadmap
What is attested today, what is in progress, and what is planned. Every "attested" item carries a link to evidence and a last-verified date. Trust shouldn't be an annual claim.
Last verified 5/1/2026, 4:28:17 PM · commit c6eee3e
Secure SDLC
Dependency Management
Daily automated vulnerability scanning
grype + pip-audit + cargo-audit + bun pm audit, daily 09:00 UTC, plus continuous Aikido on every lockfile push.
CycloneDX SBOM generation per release
2,672 components tracked across npm/pypi/cargo with NTIA enrichment.
Disclosure
Published responsible disclosure policy
48h ack SLA, 7-day assessment, 30-day critical fix target.
SOC 2
SOC 2 Type I
Audit in progress. Type I attestation expected end of May 2026.
SOC 2 Type II
Scheduled after Type I attestation and observation period (typically 6–12 months).
ISO 27001
ISO 27001 certification
Privacy
Data Processing Agreement (DPA)
Standard DPA available under NDA on request.
Subprocessor list
Studio runs locally; LLM provider is customer-selected and -contracted.
GDPR alignment
Local-first execution model minimises personal-data flow to PeerAI. Formal DPIA scheduled after SOC 2 Type I closes.