Trust Centre
The first AI assessment your auditor can reproduce
Every score is computed by a versioned, published methodology and every benchmark is k-anonymised. On the board-tier modules a second AI model can independently re-check the first, and the record shows whether that check ran. This page is the one-stop answer to “where did this number come from, and can I verify it?”
Live status · read from production, refreshed every 5 minutes
Healthy
Platform heartbeat · 0 min ago
2537
Scheduled jobs completed, last 24h · 25 failure(s)
Tokyo, Japan
Primary data residency (EU & India cells on the roadmap)
Forecast calibration certificate · accruing (0/20)
Every trajectory forecast we issue is logged as a scoreable prediction and graded against the org's real later assessments. 0 of the 20 matured predictions required have been scored — accuracy figures publish automatically at 20, not before.
Tenant isolation on every request
Every request is scoped to your organisation by explicit organisation filters in our application code, enforced by an automated cross-tenant test that fails the build if a query loses its filter. Postgres row-level security is enabled on every tenant table as a second line of defence against direct database access. A separate CI guard fails the build if any tenant table ships without it.
Reproducible, versioned scoring
Each assessment stores its methodology version. An auditor (or our own verification endpoint) can recompute any historical score from the stored answers and that exact methodology — band edits require a new version; history is immutable.
Benchmarks without data sharing
Peer comparisons read only k-anonymised cohort aggregates (minimum cohort of 5, enforced by a database constraint) built from explicitly consenting organisations. Raw assessment data never leaves any tenant. Consent is revocable and takes effect within one nightly cycle.
A second model on board-tier analysis
On 12 board-tier modules, including the board pack, the analysis is independently re-generated by a second frontier model from a different vendor when a second AI provider is configured, and a deterministic comparison flags material disagreements (numbers, recommendations) for human review instead of silently picking a winner. When that second pass does not run, the output is single-model and carries no consensus record, so its absence is visible rather than assumed.
Provenance on every figure
Cockpit tiles, oversight items and board decks carry their source module, signal freshness, and methodology version. When inputs change after a deck is generated, it is visibly flagged stale — never silently served.
Append-only audit trail
Sensitive and privileged actions, and every analysis the AI engine generates, are written to an append-only, hash-chained audit log that only the service role can write to. GDPR data-export and right-to-erasure endpoints are live in-product.
Independent assurance
Where each audit and test stands today. We list a report or certificate only once it has been issued.
| Assurance | Status | Detail |
|---|---|---|
| SOC 2 Type I | In preparation | Controls are mapped and evidenced in our readiness programme. No report has been issued. |
| SOC 2 Type II | Not started | Follows Type I, over a 6–12 month observation window. No report has been issued. |
| ISO/IEC 27001:2022 | In preparation | Statement of Applicability and ISMS documents drafted. No certificate is held. |
| Independent penetration test | Not started | Scope written; no test has been performed yet. |
Security control coverage · SOC 2 & ISO 27001
Our controls, mapped and version-controlled
We run our own security programme as version-controlled, CI-tested code. Each operating control maps to the SOC 2 Trust Services Criteria and the ISO/IEC 27001:2022 Annex A controls it satisfies. Status is labelled honestly — readiness is underway; we do not claim a certificate we do not hold.
25
Operating controls, mapped to SOC 2 + ISO 27001
29
SOC 2 Trust Services Criteria covered
93
ISO 27001:2022 Annex A controls assessed
92.8%
Annex A readiness (applicable controls)
ISO 27001 Statement of Applicability · readiness by theme
| Control | SOC 2 | ISO 27001:2022 | Status |
|---|---|---|---|
| Logical access & role-based authorisation | CC6.1, CC6.2, CC6.3 | A.5.15, A.8.2, A.8.5 | Implemented |
| Multi-tenant data isolation | CC6.1, CC6.6 | A.8.3, A.5.15 | Implemented |
| Enterprise SSO & automated provisioning | CC6.1, CC6.2, CC6.3 | A.5.16, A.5.17, A.5.18 | In progress |
| Encryption in transit | CC6.7 | A.8.24, A.8.20 | Implemented |
| Encryption at rest | CC6.1, C1.1 | A.8.24 | Implemented |
| Field-level encryption, key management & BYOK readiness | CC6.1 | A.8.24 | In progress |
| Tamper-evident audit logging | CC7.2, CC7.3 | A.8.15 | Implemented |
| Security event export to SIEM | CC7.2 | A.8.15, A.8.16 | Implemented |
| Application monitoring & error tracking | CC7.1, CC7.2 | A.8.16 | In progress |
| Vulnerability management (SAST/SCA/SBOM/secrets) | CC7.1, CC8.1 | A.8.8, A.8.25, A.8.28 | Implemented |
| Penetration testing & red-team | CC4.1, CC7.1 | A.8.8 | Planned |
| Secure change management & SDLC | CC8.1 | A.8.25, A.8.28, A.8.32 | In progress |
| Input validation & malicious-upload defence | CC6.1, CC8.1 | A.8.26 | Implemented |
| PII minimisation in logs | C1.1, P4.1 | A.8.11, A.8.12 | Implemented |
| Data-subject rights (access, portability, erasure) | P5.1, P6.1, P6.2 | A.5.34 | Implemented |
| Consent management & lawful basis | P3.1, P4.1 | A.5.34 | Implemented |
| Record of Processing Activities (Art. 30) | P1.1, P6.4 | A.5.34 | Implemented |
| Data residency control & monitoring | C1.1, CC6.1 | A.5.34, A.8.3 | In progress |
| Sub-processor & vendor management | CC9.2 | A.5.19, A.5.21, A.5.22 | In progress |
| Sanctions & trade-control screening | CC9.2 | A.5.31 | In progress |
| Availability commitment & SLA | A1.1, A1.2 | A.5.30 | In progress |
| Backup, point-in-time recovery & DR | A1.2, A1.3 | A.8.13, A.5.30 | Planned |
| Incident response & breach notification | CC7.3, CC7.4, CC7.5 | A.5.24, A.5.25, A.5.26 | In progress |
| Risk assessment & treatment | CC3.1, CC3.2, CC3.4 | A.5.2, A.8.8 | Implemented |
| AI governance & model accountability | CC1.1, CC2.1 | A.5.1, A.5.36 | Implemented |
The full Statement of Applicability (all 93 Annex A controls), our SOC 2 control matrix and policy pack are available to Enterprise prospects under NDA — care@vouliiq.com.
Methodology cross-walk · v2.0
Every dimension maps to external controls
The 15 SOVEREIGN dimensions cross-walk to controls in NIST AI RMF, ISO/IEC 42001, the EU AI Act and the OECD AI Principles, so your analysts can validate the methodology against frameworks they already trust. The full rationale is published in the methodology whitepaper.
How Vouli IQ governs its own AI is set out control by control, against the NIST AI RMF and the EU AI Act, on the AI governance page.
| Dimension | Pillar | External controls |
|---|---|---|
| D01 · Vision & North Star Clarity | Strategic Alignment | NIST AI Risk Management Framework (AI RMF 1.0) — GOVERN 1.1 — legal/regulatory context and organisational AI strategy ISO/IEC 42001 — AI Management System — ISO/IEC 42001 §5.2 — AI policy set by top management |
| D02 · Business Outcome Definition | Strategic Alignment | NIST AI Risk Management Framework (AI RMF 1.0) — MAP 1.3 — organisational mission and goals for the AI system ISO/IEC 42001 — AI Management System — ISO/IEC 42001 §6.2 — AI objectives and planning to achieve them |
| D03 · Data Readiness & Quality | Operational Readiness | NIST AI Risk Management Framework (AI RMF 1.0) — MEASURE 2.2 — representativeness and provenance of data EU AI Act Compliance Framework — EU AI Act Art. 10 — data and data governance for high-risk systems |
| D04 · Architecture & Platform Maturity | Operational Readiness | ISO/IEC 42001 — AI Management System — ISO/IEC 42001 §7.1 — resources for the AI management system IBM AI Ladder — IBM AI Ladder — modernise/collect: information architecture readiness |
| D05 · ROI Tracking & Benefit Realization | Value Realization | ISO/IEC 42001 — AI Management System — ISO/IEC 42001 §9.1 — monitoring, measurement, analysis and evaluation McKinsey AI Adoption Framework — McKinsey AI Adoption — value assurance: tracked impact per use case |
| D06 · Portfolio Prioritization | Value Realization | NIST AI Risk Management Framework (AI RMF 1.0) — MAP 3.1 — benefits of intended purpose weighed against risks Gartner AI Maturity Model — Gartner AI Maturity — portfolio: systematic use-case prioritisation |
| D07 · Delivery Operating Model | Execution Excellence | ISO/IEC 42001 — AI Management System — ISO/IEC 42001 §8.1 — operational planning and control McKinsey AI Adoption Framework — McKinsey AI Adoption — operating model and delivery archetypes |
| D08 · Change Management & Adoption | Execution Excellence | NIST AI Risk Management Framework (AI RMF 1.0) — GOVERN 4.2 — organisational culture and workforce engagement with AI risk Gartner AI Maturity Model — Gartner AI Maturity — adoption: measured change and enablement |
| D09 · AI & Operational Risk Management | Risk & Resilience | NIST AI Risk Management Framework (AI RMF 1.0) — MANAGE 1.2 — treatment of documented AI risks by priority EU AI Act Compliance Framework — EU AI Act Art. 9 — risk management system across the lifecycle ISO/IEC 42001 — AI Management System — ISO/IEC 42001 §6.1 — actions to address risks and opportunities |
| D10 · Security & Responsible AI Posture | Risk & Resilience | NIST AI Risk Management Framework (AI RMF 1.0) — MEASURE 2.7 — security and resilience (secure-by-design, red-teaming) IEEE 7000 — Ethical Systems Design — IEEE 7000 — ethical values elicitation in system design Microsoft Responsible AI Framework — Microsoft Responsible AI — reliability & safety, privacy & security |
| D11 · Stakeholder & Partner Ecosystem | Ecosystem | NIST AI Risk Management Framework (AI RMF 1.0) — GOVERN 5.1 — engagement of relevant AI actors and external stakeholders OECD AI Principles — OECD Principle 1.5 — accountability across the AI value chain |
| D12 · Innovation Pipeline & Experimentation | Innovation IQ | Gartner AI Maturity Model — Gartner AI Maturity — experimentation cadence and incubation discipline OECD AI Principles — OECD Principle 2.4 — fostering a digital ecosystem for trustworthy AI |
| D13 · AI Governance & Compliance | Governance | NIST AI Risk Management Framework (AI RMF 1.0) — GOVERN 1.4 — risk management governance structures and lines of accountability ISO/IEC 42001 — AI Management System — ISO/IEC 42001 §5.3 — roles, responsibilities and authorities EU AI Act Compliance Framework — EU AI Act Art. 17 — quality management system for providers |
| D14 · Talent, Capability & Workforce | Governance | ISO/IEC 42001 — AI Management System — ISO/IEC 42001 §7.2 — competence of persons affecting AI performance OECD AI Principles — OECD Principle 2.3 — building human capacity for the AI transition |
| D15 · Course-Correction & Learning | Navigational Agility | NIST AI Risk Management Framework (AI RMF 1.0) — MANAGE 4.1 — post-deployment monitoring with course-correction mechanisms ISO/IEC 42001 — AI Management System — ISO/IEC 42001 §10.1 — continual improvement of the AI management system |
Sub-processors
Who touches your data
Vercel
Application hosting and edge network
Supabase
Postgres database, storage, vector search
Clerk
Authentication, SSO and user management
Anthropic
AI generation (primary model provider)
OpenAI
AI generation (fallback + consensus second opinion)
Cohere
Retrieval re-ranking (RAG); PII redacted before egress
Dodo Payments
Payments (merchant of record)
Resend
Transactional email
Sentry
Error monitoring
PostHog
Product analytics
Cloudflare
Bot protection on public forms, when enabled
DPA, security questionnaires (SIG / CAIQ) and the methodology whitepaper are available on request — care@vouliiq.com.
Certification roadmap
- SOC 2 Type II — readiness underway, tracked as controls-and-evidence inside our own M28 Assurance & Evidence Vault (we run our compliance programme on the product we sell).
- ISO/IEC 42001 (AI management system) — readiness underway; the methodology cross-walk above is the working control map.
- GDPR — data-export and right-to-erasure endpoints live in-product today. Data currently resides in a single region (AWS Tokyo); dedicated EU and India residency cells are on the Enterprise roadmap and are offered only once a cell is live — we will not state a residency we cannot yet provide.
We label in-progress certifications honestly. Nothing on this page claims a certificate we do not hold.