Trust Center
How Decision Keep keeps your evidence safe, and the controls that map to SOC 2 and ISO/IEC 27001. We designed the product to be approved: every control below is shipped in code, not a slide. An independent SOC 2 / ISO 27001 attestation is a scoped engagement we kick off after a paid pilot confirms the evidence trail with your organisation.
Compliance posture
Decision Keep is engineered to pass an independent audit rather than to be retro-fitted for one. Controls are implemented and enforced in the product today, and we maintain a full control-to-code mapping (SOC 2 + ISO/IEC 27001) plus a documented threat model, a data-processing agreement template, and an incident-response runbook. Formal attestation reports (SOC 2 Type II / ISO 27001) are performed by an independent auditor as a scoped, paid engagement.
Control-to-code mapping
What security controls are implemented, and where is the evidence?
Each control below is implemented and enforced in the shipping product, with the exact code location an assessor can inspect.
Least privilege & access control
SOC 2 CC6.1 / ISO 27001 A.5.15, A.8.2Role-based access control (owner, admin, member, auditor, viewer) enforced centrally in src/lib/rbac.ts; every protected action gates through can().
Multi-factor authentication
SOC 2 CC6.1 / ISO 27001 A.8.5TOTP MFA with recovery codes (src/lib/security/mfa), account lockout and rate limiting (src/lib/security/lockout, src/lib/guard).
Strong session & token management
SOC 2 CC6.6 / ISO 27001 A.8.2Short-lived, HMAC-signed session/access tokens with enforced expiry; OAuth2 service-account tokens for machine access (src/lib/oauth.ts).
Data at rest & in transit encryption
SOC 2 CC6.7 / ISO 27001 A.8.2Envelope-encrypted org signing keys (src/lib/kms), TLS in transit, and optional HSM/KMS backends (Vault, AWS/GCP/Azure) where the private key never leaves the provider.
Tamper-evident, append-only record
SOC 2 CC7.2 / ISO 27001 A.8.15SHA-256 hash chain + Ed25519 signatures (src/lib/crypto) with offline, trustless verification (scripts/verify-ledger.mjs).
Audit logging
SOC 2 CC7.1 / ISO 27001 A.8.15Append-only audit trail, structured JSON logs to a SIEM, and security-event recording (src/lib/audit, src/lib/security/events).
Secure development & supply chain
ISO 27001 A.8.25–A.8.28gitleaks secret scan, npm audit, validated CycloneDX SBOM into Dependency-Track, and a coverage gate in CI.
Coordinated vulnerability disclosure
ISO 27001 A.5.28RFC 9116 security.txt published at /.well-known/security.txt with a stated acknowledgement target.
Documentation you can hand over
- Security & procurement – controls, MFA/SSO, data residency, key management.
- Compliance & standards – mapping to the EU AI Act, ISO/IEC 42001, SOC 2, APP 1.7–1.9 and GDPR.
- API reference – including OAuth2 service-account access.
- security.txt – coordinated disclosure (RFC 9116).
See the Forensic Witness on your stack
Book a personalised demo and we'll map Decision Keep to your automated-decision obligations and show the evidence trail end to end.