Compliance & trust

Built to clear a security review on day one.

SOC 2 Type I/II, ISO 27001, ISO 42001 and a GDPR-aware data layer — region-pinned to the EU when traffic requires it. The controls procurement asks for are on by default.

SOC 2 Type II
ISO 27001
ISO 42001
GDPR-aware data layer

The four controls we cover.

Each control maps to a claim we will sign in the security review packet — not a forward promise, a verifiable one.

SOC 2

Type I/II

In audit — Type II report under preparation

Data handling across Shopify + Meta + Google + TikTok feeds

CCCommon CriteriaGovernance, risk and control environment across the platform.
AAvailabilityUptime targets and incident response on every connected channel.
CConfidentialityInformation classified, labelled and protected at the boundary.
PIProcessing IntegrityLevers execute inside the merchant's rails and write back to the ledger.
PPrivacyPersonal data handling consistent with the GDPR-aware data layer.

ISO 27001

Information Security

In certification — Annex A controls mapped, SoA in draft

Access control: RBAC, MFA, audit logs, just-in-time admin

ACRBAC + MFA + JIT adminEvery privileged action requires role + MFA; admin scopes past 24h go through just-in-time elevation with a ticket.
AUAudit logging & retentionEvery privileged action writes to an append-only trail (who, what, on which resource, against which guardrail), retained for the contractual window.
VRVendor risk reviewsEach sub-processor is reviewed annually — SOC 2 / ISO 27001 evidence, data-flow scope, region of processing, exit plan if the vendor fails.
CMChange management & secure SDLCEvery lever-deploying change ships through peer review, automated tests and a security gate before it reaches production.

ISO 42001

AI Management

In certification — AI risk register under preparation

AI governance: model risk register, dataset lineage, prompt-injection controls

MRModel risk registerEvery AI model that pulls a lever is registered with risk tier, named owner, tolerable residual risk and a quarterly review.
DLDataset lineageEach model carries a versioned lineage pointer on its training / eval data, so a retrain stays reproducible and an audit can trace any decision back to the data it saw.
PIPrompt-injection controlsInbound prompts pass an injection-screening layer before they reach model context; anything flagged is refused at the guardrail and journalised, never echoed.
HOHuman override + eval suiteA human override at the guardrail layer logs who overrode what and the effect on the next bill; the eval suite runs on every model change and before every release.

GDPR

EU data layer

GDPR-aware data layer — DPA available under mutual NDA

EU data residency: region-pinned processing + data minimisation

LBLawful basis per purposeEach processing purpose names its lawful basis (Art. 6 GDPR) before the data-plane endpoint is wired — recorded in the DPA, not improvised at incident time.
DMData minimisationOnly the fields the lever needs are pulled from Shopify, Meta, Google and TikTok — nothing broader is fetched, cached or written to the ledger.
EUEU region pinningEU merchant traffic stays in EU-managed Postgres + EU object storage; US traffic stays in US — no cross-region replication of customer rows.
SPSub-processor transparency & SCCsThe full sub-processor list ships with the DPA; every cross-border transfer runs on the EU Standard Contractual Clauses, with transfer impact assessment on record.

Each of the six rights below is wired into the data-plane endpoint — not improvised at incident time. The Art. 15–22 enumeration below is the same set the DPA carries.

Art. 15Right of accessConfirm whether personal data is processed and obtain a copy in a portable format within 30 days of a verified request.
Art. 16Right to rectificationCorrect inaccurate personal data without undue delay; the corrected row replaces the previous one in the audit trail with a timestamped journal entry.
Art. 17Right to erasureDelete personal data on a verified request once the processing purpose no longer applies; the action is journalised, not silent, and propagates to active sub-processors within the contractual window.
Art. 18Right to restrictionPause processing of a specific data row while a dispute is open; the row stays in storage, but no lever reads or writes it until the dispute closes.
Art. 20Right to data portabilityReceive personal data in a structured, machine-readable format, and transmit it to another controller where technically feasible.
Arts. 21–22Right to object & opt-out of automated decisionsObject to processing based on legitimate interest and opt out of decisions taken solely by automated means — the lever layer is built so a human can take the decision back at the guardrail.

How the data is handled.

Every lever runs on data that has already passed the controls above. Encryption at rest uses AES-256 across managed Postgres and managed object storage. Encryption in transit uses TLS 1.2 or higher between Helmsway, the connected channels and your storefront — older versions are refused at the boundary. Access is role-segmented: every privileged action writes to an audit trail of who acted, what action, on which resource and against which guardrail — and that trail is retained for the contractual window.

AES-256 at rest
TLS 1.2 or higher in transit
Audit trail on every privileged action

Incident response — tiered timeline.

Every confirmed security or privacy event runs through the same on-call flow, regardless of severity. The timeline below is what gets posted in the customer advisory — containment, regulator notification, customer notification, post-mortem.

T+1hContainment
On-call isolation of the affected service, key rotation on impacted credentials, and a halt to all open levers that touch the affected data path — no further write-backs until scope is bounded.
T+24hNotify DPA
Lead supervisory authority notified via the in-DPA escalation channel; the notification carries scope, affected data categories, and the containment steps already taken.
T+72hNotify customer
Every affected customer notified in plain language, with the row on the data they can verify and the workaround available until the post-mortem is published.
T+30dPost-mortem
Root cause, the control that failed, the new control that closes the gap, and the named owner for ongoing remediation — published to the customer and to internal compliance.

Audit log export

Every resolved action is downloadable as a timestamped CSV. Logged-in users can pull any date window directly from the dashboard.

Download the audit export →Read the deep trust center

AI model governance — cross-cutting.

Beyond the ISO 42001 AI management system above, every model that pulls a lever is governed by the same four controls below. They sit at the data plane, not the policy plane — so they fire on every invocation, not at every audit.

MKModel keys (own-keys to platform)OpenAI / Anthropic / vendor keys do NOT live in the customer's repo — your billing IS the platform's billing. Keys are rotated on every model change, never reused across customers, and scoped to the platform, not the customer.
MPModel provenanceProvider, model identifier and version are locked per release. A lever cannot load an undeclared model, and an eval drift between two versions of the same model blocks the release.
OROutput review (corridor re-confirmation)Every model output about to write back is re-confirmed against the merchant's corridor (MAP floor, MAP ceiling, ROAS floor, brand voice) before the lever moves. Out-of-corridor outputs are never written, even when the model produces them.
PIPrompt-injection screeningInbound prompts pass an injection-screening layer before they reach model context; flagged inputs are refused at the guardrail and journalised with intent labels — never echoed, never written back.

What this gets you. What it doesn't.

In scope

SOC 2 Type II annual letter
ISO 27001 statement of applicability
ISO 42001 AI risk register
GDPR DPA + sub-processor list + SCCs
Region-pinned EU processing
RBAC, MFA, audit logs
Encryption in transit + at rest
Named CISO contact
Downloadable audit-log export (CSV)

Out of scope

HIPAA / BAA
FedRAMP / IL5
24/7 hotline (incidents go through support SLA)
On-demand pen test
SOC 2 letter without a mutual NDA

The right-hand list is deliberate. Telling procurement what you DON'T cover buys more trust than claiming you do.

Last reviewed: 2026-08-01 → Next review 2026-Q4

Talk to security

Security review packet, on request.

The packet ships same-day, on a mutual NDA — SOC 2 letter, ISO SoA, ISO 42001 risk register, GDPR DPA + sub-processor list, data-flow diagram.

Request the packet Talk to the team