Trust Center
How Decision Keep keeps your evidence safe, and the controls that map to SOC 2 and ISO/IEC 27001. We designed the product to be approved: every control below is shipped in code, not a slide. An independent SOC 2 / ISO 27001 attestation is a scoped engagement we kick off after a paid pilot confirms the evidence trail with your organisation.
Compliance posture
Decision Keep is engineered to pass an independent audit rather than to be retro-fitted for one. Controls are implemented and enforced in the product today, and we maintain a full control-to-code mapping (SOC 2 + ISO/IEC 27001) plus a documented threat model, a data-processing agreement template, and an incident-response runbook. Formal attestation reports (SOC 2 Type II / ISO 27001) are performed by an independent auditor as a scoped, paid engagement.
Control-to-code mapping
Each control below is implemented and enforced in the shipping product, with the exact code location an assessor can inspect.
Least privilege & access control
SOC 2 CC6.1 / ISO 27001 A.5.15, A.8.2Role-based access control (owner, admin, member, auditor, viewer) enforced centrally in src/lib/rbac.ts; every protected action gates through can().
Multi-factor authentication
SOC 2 CC6.1 / ISO 27001 A.8.5TOTP MFA with recovery codes (src/lib/security/mfa), account lockout and rate limiting (src/lib/security/lockout, src/lib/guard).
Strong session & token management
SOC 2 CC6.6 / ISO 27001 A.8.2Short-lived, HMAC-signed session/access tokens with enforced expiry; OAuth2 service-account tokens for machine access (src/lib/oauth.ts).
Data at rest & in transit encryption
SOC 2 CC6.7 / ISO 27001 A.8.2Envelope-encrypted org signing keys (src/lib/kms), TLS in transit, and optional HSM/KMS backends (Vault, AWS/GCP/Azure) where the private key never leaves the provider.
Tamper-evident, append-only record
SOC 2 CC7.2 / ISO 27001 A.8.15SHA-256 hash chain + Ed25519 signatures (src/lib/crypto) with offline, trustless verification (scripts/verify-ledger.mjs).
Audit logging
SOC 2 CC7.1 / ISO 27001 A.8.15Append-only audit trail, structured JSON logs to a SIEM, and security-event recording (src/lib/audit, src/lib/security/events).
Secure development & supply chain
ISO 27001 A.8.25–A.8.28gitleaks secret scan, npm audit, validated CycloneDX SBOM into Dependency-Track, and a coverage gate in CI.
Coordinated vulnerability disclosure
ISO 27001 A.5.28RFC 9116 security.txt published at /.well-known/security.txt with a stated acknowledgement target.
Documentation you can hand over
- Security & procurement – controls, MFA/SSO, data residency, key management.
- Compliance & standards – mapping to the EU AI Act, ISO/IEC 42001, SOC 2, APP 1.7–1.9 and GDPR.
- API reference – including OAuth2 service-account access.
- Live API explorer – interactive Swagger UI for the API.
- security.txt – coordinated disclosure (RFC 9116).
See the Forensic Witness on your stack
Book a personalised demo and we'll map Decision Keep to your automated-decision obligations and show the evidence trail end to end.