Security & Compliance
What we hold, what we do not hold, and how the platform is built. SoftQuantus holds no security certifications today.
Compliance position
No third-party audit or certification is claimed. Each row states exactly where we stand, so your security reviewer does not have to find the gap.
SOC 2
Not startedNo audit has been started and no report exists.
ISO 27001
Not heldWe do not hold an ISO 27001 certificate.
GDPR
Built to requirementsBuilt to GDPR requirements. A Data Processing Agreement is available on request. This is not a certification.
HIPAA
No BAA offeredWe do not offer a Business Associate Agreement.
FedRAMP
Not heldWe hold no FedRAMP authorization.
Independent penetration test
Not yet commissionedNo third-party penetration test has been commissioned yet.
Bug bounty
No programmeWe do not run a paid bug bounty programme.
Post-quantum signatures
Implemented, not certifiedML-DSA through liboqs for QuantumLock licence tokens. Standards-based, not CAVP or FIPS validated.
How the platform is built
The controls that exist today, described as they are.
Hosting and data location
Production runs on Azure Container Apps in West Europe only. There is no multi-region deployment and no selectable data residency.
Secrets and registry access
Secrets are held in Azure Key Vault. Container images are pulled from Azure Container Registry using a managed identity.
Evidence integrity
Evidence bundles are sealed with a SHA-256 Merkle root, so a later change to any item is detectable. Sealing is an integrity check, not a digital signature.
Post-quantum cryptography
QuantumLock licence tokens use ML-DSA through liboqs. ML-KEM key generation is available; encapsulation and decapsulation are not implemented. The implementation is not CAVP or FIPS validated.
Audit logging
Platform logs are written to Azure Log Analytics and kept for 90 days.
Secure development
Changes run through CI lint and automated tests. We do not claim SAST or DAST coverage, and no independent penetration test has been commissioned yet.
Availability
We operate to a 99.9% availability target. That is a target, not a contractual SLA, and we do not currently offer SLA credits.
View platform statusReport a vulnerability
If you've discovered a vulnerability, please report it responsibly by email. We do not run a bug bounty programme, so we cannot offer a monetary reward.
Need more detail?
The procurement pack sets out our exact compliance position. For anything else, contact us.