Trust center
Where Sovaria stands, control by control, from the same control map and automated checks we will give an auditor. We are preparing for SOC 2 and ISO/IEC 27001. Neither audit has happened yet, and we will not list a certification before the report or certificate exists.
Certifications
None yet
SOC 2 Type I and ISO 27001: readiness in progress.
Controls
12 of 53 in place
35 in progress, 6 not started.
Automated evidence
Not published yet
Our evidence collectors run monthly; results appear here once published.
Controls
Mapped to the SOC 2 Trust Services Criteria and ISO/IEC 27001:2022 Annex A. “In place” means built and producing evidence; it is our own assessment, not an auditor’s.
Control environment
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-01 Integrity and ethical values | CC1.1 | A.5.1, A.5.4, A.6.2 | In progress |
| SOV-02 Board / governing body oversight | CC1.2 | Clause 5.1, 9.3 | Not started |
| SOV-03 Structure, reporting lines, authority | CC1.3 | A.5.2, A.5.3 | In progress |
| SOV-04 Competence, hiring, training | CC1.4 | A.6.1, A.6.3 | Not started |
| SOV-05 Accountability | CC1.5 | A.5.4, A.6.4 | In progress |
Communication and information
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-06 Relevant, quality information | CC2.1 | A.5.37 | In place |
| SOV-07 Internal communication of responsibilities | CC2.2 | A.5.1, A.6.3 | In progress |
| SOV-08 External communication | CC2.3 | A.5.5, A.5.6, A.6.8 | In progress |
Risk assessment
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-09 Objectives specified | CC3.1 | Clause 6.2 | In progress |
| SOV-10 Risk identification and analysis | CC3.2 | Clause 6.1.2, 8.2, A.5.7 | In progress |
| SOV-11 Fraud risk | CC3.3 | A.5.7 | In progress |
| SOV-12 Significant change assessed | CC3.4 | Clause 6.3, 8.2 | In progress |
Monitoring
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-13 Ongoing and separate evaluations | CC4.1 | A.5.35, A.5.36, Clause 9.2 | In progress |
| SOV-14 Deficiencies communicated and fixed | CC4.2 | Clause 10.1, 10.2 | In place |
Control activities
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-15 Controls selected to mitigate risk | CC5.1 | Clause 6.1.3 (SoA) | In progress |
| SOV-16 Technology general controls | CC5.2 | A.8.x | In place |
| SOV-17 Policies and procedures deployed | CC5.3 | A.5.1, A.5.37 | In progress |
Logical and physical access
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-18 Staff access to the Control Center | CC6.1 | A.5.15, A.5.16, A.5.17, A.8.2, A.8.5 | In place |
| SOV-19 Per-engine database and Redis credentials (SYS-02) | CC6.1 | A.8.2, A.8.3, A.8.4 | In place |
| SOV-20 Internal service authentication | CC6.1 | A.8.5, A.5.17 | In place |
| SOV-21 Asset inventory | CC6.1 | A.5.9, A.5.10, A.5.11 | In progress |
| SOV-22 Provisioning and de-provisioning | CC6.2 | A.5.16, A.5.18, A.6.5 | In progress |
| SOV-23 Role-based access and periodic review | CC6.3 | A.5.18, A.8.2 | In progress |
| SOV-24 Physical access | CC6.4 | A.7.1–A.7.6, A.7.8, A.7.11–A.7.13 | In place |
| SOV-25 Disposal of data and assets | CC6.5 | A.7.14, A.8.10 | In progress |
| SOV-26 Boundary protection | CC6.6 | A.8.20, A.8.21, A.8.22 | In progress |
| SOV-27 Network segmentation | CC6.6 | A.8.22 | In progress |
| SOV-28 Encryption in transit | CC6.7 | A.8.24, A.5.14 | In progress |
| SOV-29 Encryption at rest and key management | CC6.1 | A.8.24 | In progress |
| SOV-30 Malicious and unauthorised software | CC6.8 | A.8.7, A.8.19 | In progress |
| SOV-31 Privileged utilities | CC6.1 | A.8.18 | In progress |
| SOV-52 Source code and CI access (GitHub) | CC6.1 | A.8.4, A.5.17, A.8.5 | Not started |
System operations
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-32 Vulnerability and configuration management | CC7.1 | A.8.8, A.8.9 | In progress |
| SOV-33 Monitoring for anomalies | CC7.2 | A.8.15, A.8.16, A.8.17 | In progress |
| SOV-34 Security event evaluation | CC7.3 | A.5.25, A.6.8 | In place |
| SOV-35 Incident response | CC7.4 | A.5.24, A.5.26, A.5.28 | In progress |
| SOV-36 Recovery from incidents | CC7.5 | A.5.27, A.5.29 | In progress |
Change management
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-37 Controlled deployment | CC8.1 | A.8.32 | In place |
| SOV-38 Change review and approval | CC8.1 | A.8.25, A.8.28, A.8.32 | Not started |
| SOV-39 Testing and environment separation | CC8.1 | A.8.29, A.8.31, A.8.33 | In progress |
| SOV-40 Secure development lifecycle | CC8.1 | A.8.25, A.8.26, A.8.27, A.8.28, A.5.8 | In progress |
Risk mitigation and vendors
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-41 Business disruption risk | CC9.1 | A.5.29, A.5.30 | Not started |
| SOV-42 Vendor and business partner risk | CC9.2 | A.5.19, A.5.20, A.5.21, A.5.22, A.5.23 | In progress |
Availability
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-43 Capacity management | A1.1 | A.8.6 | In place |
| SOV-44 Backups and recovery infrastructure | A1.2 | A.8.13, A.8.14, A.5.30 | In progress |
| SOV-45 Recovery testing | A1.3 | A.5.30, A.8.13 | In place |
Confidentiality
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-46 Identify and protect confidential information | C1.1 | A.5.12, A.5.13, A.5.34, A.8.11, A.8.12 | In progress |
| SOV-47 Dispose of confidential information | C1.2 | A.8.10, A.5.33 | In progress |
| SOV-53 CERT-In subscriber records (5 years after closure) | C1.2 | A.5.31, A.5.33 | In progress |
Other controls
| Control | SOC 2 | ISO 27001 | Status |
|---|
| SOV-48 Legal, regulatory and contractual requirements | — | A.5.31, A.5.32, A.5.34 | In progress |
| SOV-49 Endpoint devices and remote work | — | A.8.1, A.6.7, A.7.7, A.7.9, A.7.10 | Not started |
| SOV-50 Protection during audit testing | — | A.8.34 | In place |
| SOV-51 Threat intelligence | — | A.5.7 | In progress |
For your own audits
Organization owners and admins can download an evidence pack for their organization or one project from the console (Organization › Compliance): audit log check, encryption and backups, access matrix, Security Advisor findings, data region and subprocessors.
