Security, certification readiness, and AI governance — stated honestly.
Evalio is preparing ISO/IEC 27001-aligned and SOC 2 readiness controls. No external audit has been completed. This page documents what is implemented, what evidence is being prepared, and what cannot yet be claimed.
Security overview
Evalio's security posture rests on tenant-isolated workspaces, server-side authorization, sealed audit registers, and human-governed AI boundaries. Controls are documented in the register below; certification status is shown without inflated claims.
Data is scoped to the workspace that owns it. Cross-workspace access requires an elevated, logged platform role.
Sensitive actions are sealed to a register row history. Admin overrides record the actor, target, and reason.
Service runs on managed infrastructure with provider-level backups; recovery procedures are being tested.
AI prepares evidence; consultants review; clients decide. AI never assigns pay, grade, promotion, or legal status.
Data protection posture
Data is encrypted in transit (TLS) and at rest by the managed database. Personal data categories, retention periods, and deletion rules are documented in the retention register on this page.
Access control
Access is enforced by roles, scopes, and module verbs. Permissions are checked server-side via row-level security; client-side checks are presentational only. Access reviews are documented on a quarterly cadence.
Tenant isolation
Each workspace is logically segregated. Workspace membership is required to read or write workspace-scoped tables. Cross-workspace access is restricted to platform owner, admin, or governance roles, and every override is recorded.
Audit logging
Sensitive register changes write to a sealed history table. Admin enforcement actions are recorded separately with actor, target, and reason. Logs are scoped by role; raw access requires a platform-level role.
AI governance
Source-rights discipline
Salary surveys and external benchmarks are used strictly under each source's licence. Source-rights flags travel with every output. Proprietary values are never re-published; previews show qualitative state, not raw figures.
Incident response readiness
Detection, escalation, containment, and post-mortem procedures are documented and being formalised. The severity scale and response SLAs are under review prior to publication.
Business continuity readiness
The continuity plan is being prepared with named owners and tested recovery steps. The first tabletop exercise is scheduled.
Certification readiness
Evalio is not currently certified against ISO/IEC 27001, SOC 2, GDPR, or any other framework. The states below describe internal readiness — not external attestation.
Security control register
One row per control area. Status, evidence, owner, review state, and next action are stated explicitly. No control is marked complete without documented evidence.
| Control area | Objective | Status | Evidence required | Owner | Review | Next action |
|---|---|---|---|---|---|---|
| Access control | Least-privilege access enforced via roles, scopes, and module verbs. | In progress | Role/permission matrix export; periodic access review records. | Platform admin | In review | Document quarterly access review cadence. |
| Authentication | Identity verified through company-domain sign-in; generic providers blocked. | In progress | Auth provider configuration; password policy; HIBP check status. | Platform admin | In review | Enable leaked-password protection in production. |
| Authorization | Permissions enforced server-side via row-level security and module verb checks. | Implemented | RLS policy export; module verb tests. | Platform admin | Reviewed | Schedule next quarterly RLS regression. |
| Tenant isolation | Workspace data is segregated; cross-workspace access requires elevated platform role. | Implemented | Workspace membership policies; segregation tests. | Platform admin | Reviewed | Re-run tenant isolation tests after schema changes. |
| Data retention | Retention windows defined per data category with documented deletion rules. | Evidence required | Retention policy register; deletion job logs. | Governance | Pending | Approve baseline retention policies. |
| Audit logs | Sensitive actions sealed to register row history; admin overrides logged separately. | Implemented | Register row history; admin override log entries. | Platform admin | Reviewed | Confirm log retention duration. |
| Encryption | Data encrypted in transit (TLS) and at rest by the managed database. | Implemented | Provider attestations; TLS configuration record. | Platform admin | Reviewed | Document key management ownership. |
| Backup and recovery | Managed backups with documented RPO and RTO targets. | Evidence required | Backup schedule; restoration test record. | Platform admin | Pending | Run a documented restore drill. |
| Incident response | Documented detection, escalation, containment, and post-mortem flow. | In progress | Incident runbook; on-call rotation; severity matrix. | Platform admin | In review | Publish severity scale and SLA targets. |
| Vendor / subprocessor management | Subprocessor inventory maintained with data access classification. | Evidence required | Subprocessor register; DPA references. | Governance | Pending | Confirm baseline subprocessor list and categories. |
| Secure development | Code review, automated checks, and dependency scanning before release. | In progress | CI policy; dependency scan results; review records. | Platform admin | In review | Define minimum review and scan policy. |
| Change management | Schema and release changes are gated through migrations and review. | Implemented | Migration history; release approver register. | Platform admin | Reviewed | Confirm production release approver assignment. |
| AI governance | AI prepares evidence; humans decide. AI never decides pay, grade, promotion, entitlement, or legal status. | Implemented | Companion mode registry; boundary copy on every AI surface. | Governance | Reviewed | Refresh AI boundary copy on each module addition. |
| Privacy | Personal data handling documented, scoped, and reviewable. | In progress | Privacy notice; PII categories register; data subject request procedure. | Governance | In review | Publish data subject request procedure. |
| Business continuity | Service continuity plan with named owners and tested recovery steps. | Evidence required | Business continuity plan document; tabletop exercise record. | Platform admin | Pending | Schedule first business continuity tabletop exercise. |
Subprocessors
Categories of vendors that may process data on Evalio's behalf. Specific vendor identification and DPA references are confirmed under enterprise engagements.
| Subprocessor | Category | Data access | Status |
|---|---|---|---|
| Managed database provider | Database hosting | Application data | approved |
| Application hosting platform | Compute / edge runtime | Application traffic | approved |
| Email delivery provider | Transactional email | Recipient metadata | under review |
| Object storage provider | File storage | Workspace artifacts | proposed |
| Error monitoring provider | Observability | Error metadata | proposed |
| Analytics provider | Product analytics | Usage metadata | proposed |
Data retention
| Data category | Retention period | Deletion rule | Review state |
|---|---|---|---|
| Authentication logs | 12 months | Rolling deletion after window expires. | in review |
| Audit register history | Workspace lifetime + 7 years | Sealed; deletion only on documented request. | in review |
| Workspace artifacts | Workspace lifetime | Deleted on workspace closure request. | in review |
| Personal contact data | 24 months from last contact | Anonymised on request or at end of period. | draft |
| Misuse signals | 30 days rolling | Aggregated to enforcement state then dropped. | in review |
| Backups | 35 days rolling | Provider-managed snapshot rotation. | draft |
Launch readiness summary
Tenant isolation, server-side authorization (RLS), sealed audit history, admin override logging, encryption in transit and at rest, governed AI boundaries, change management via migrations.
Quarterly access reviews, restoration drill, incident severity scale and SLA, secure-development policy, data subject request procedure, business continuity tabletop.
ISO/IEC 27001 certification, SOC 2 Type I/II reports, formal privacy attestations. None of these are currently complete.
Evalio is NOT ISO certified, NOT SOC 2 certified, NOT GDPR certified, and has NOT completed any independent security audit. Any claim to the contrary should be reported to security@evalio.
For enterprise reviews, contact your Evalio sponsor for the latest control evidence package. Privacy · Terms · AI Governance