security · document Q-S1 · revision 1 · 2026-11-01
Run to the standards. Not yet certified against them.
Q Division runs its controls to ISO/IEC 27001, SOC 2 and the GDPR. No certificate or attestation has been obtained, and none is claimed. This page says what is in force, which clause or criterion each control answers to, and where it stands today.
the position
Three frameworks, one plain statement each.
Following a standard and being certified against it are different things, and this page keeps them apart. The controls below are built and operated with these three frameworks as the reference. An independent audit has not been carried out, so there is no certificate, no SOC 2 report and no GDPR certification to show. When any of them is obtained, it will be stated here with its date and scope.
- ISO/IEC 27001:2022
- The information security management standard. Controls are mapped to Annex A.
- followed · not certified
- SOC 2
- The Trust Services Criteria for security, availability, confidentiality, processing integrity and privacy.
- followed · no attestation report
- GDPR
- The processor's obligations under the General Data Protection Regulation, and the controller's where Q Division is one.
- followed · no certification scheme joined
the crosswalk
Each control, and what it answers to.
Twelve controls. The references are the clauses and criteria each one speaks to; they are a map, not a claim of conformance.
01
Tenant isolation
Row-level security forced in PostgreSQL with a runtime role that is not a superuser. A request without tenant context sees no rows.
ISO 27001 Annex AA 8.3 · A 5.15
SOC 2CC6.1
GDPRArt. 25 · Art. 32
todayin force
02
Keys and access
Keys are issued per organisation, with a named administrator. Rotation is the organisation's act, on suspicion or on schedule.
ISO 27001 Annex AA 5.18 · A 8.5
SOC 2CC6.2 · CC6.3
GDPRArt. 32
todayin force
03
A person before a protected action
Runs stop before protected actions. Each approval is bound to the tenant, the person, the run and the action version, and expires unused.
ISO 27001 Annex AA 5.3
SOC 2PI1.3
GDPRArt. 22
todayin force
04
The journal
Every step, decision and cost is appended in sequence and never rewritten. Runs replay from it; evidence is assembled from it.
ISO 27001 Annex AA 8.15 · A 5.33
SOC 2CC7.2
GDPRArt. 5(2) · Art. 30
todayin force
05
The guards
Input guards against injection and malformed requests. Output guards against leaked personal data and claims without a source. Cost guards for budgets and rate limits.
ISO 27001 Annex AA 8.11 · A 8.12
SOC 2CC6.7 · PI1.2
GDPRArt. 5(1)(f) · Art. 32
todayin force
06
Encryption in transit
Calls to model providers and connected systems are made over HTTPS. Encryption at rest is provided by the hosting platform and will be stated here with its scope.
ISO 27001 Annex AA 8.24
SOC 2CC6.7
GDPRArt. 32
todayin transit in force · at rest to be stated
07
Retention and erasure
Logs 7 days and traces 30 by default, under a policy each organisation can tighten. Erasure removes derived records at once and returns a receipt of what remains to be attested.
ISO 27001 Annex AA 8.10
SOC 2C1.2 · P4.3
GDPRArt. 5(1)(e) · Art. 17
todayin force
08
Logging and operator access
Request logs and traces are kept within the tenant's scope. Q Division operators reach a tenant's records only for support.
ISO 27001 Annex AA 8.15 · A 8.16
SOC 2CC7.2
GDPRArt. 32
todayin force
09
Change control and release gates
Every change passes the required checks, including dependency audit and static analysis, before release. Seven production gates are defined; none has yet been passed, and dependency remediation is open.
ISO 27001 Annex AA 8.25 · A 8.29 · A 8.32
SOC 2CC8.1
GDPRArt. 25
todayin force locally · 0 of 7 gates passed
10
Backup and restore
A scripted drill dumps the database, restores it into a disposable database, upgrades it, and checks that row-level security and role limits hold after restore.
ISO 27001 Annex AA 8.13
SOC 2A1.2
GDPRArt. 32(1)(c)
todaydrill scripted · platform backups to be stated
11
Suppliers
Sub-processors are listed by category on the data protection page, with the provider in service today. Organisations are told before a new one handles their data.
ISO 27001 Annex AA 5.19 · A 5.21
SOC 2CC9.2
GDPRArt. 28(2) · Art. 28(4)
todayin force · locations to be confirmed
12
Incidents and disclosure
Organisations are told without undue delay of a breach affecting their data. Reports from researchers go to the address below and are acknowledged within two working days.
ISO 27001 Annex AA 5.24 · A 5.26
SOC 2CC7.3 · CC7.4
GDPRArt. 33(2)
todayin force · runbook in writing
references are to ISO/IEC 27001:2022 Annex A, the 2017 Trust Services Criteria and the GDPR · a map, not a conformance claim
responsible disclosure
If you find something.
Write to the address below with what you found and how to reproduce it. You will have an acknowledgement within two working days and a plain account of what was done about it. Test only against a tenant you own; never against another organisation's data. There is no bounty programme today, and that will be stated here if one opens.
- report to
- q@elementary.mu
- acknowledgement
- within two working days
- scope
- your own tenant · the public documentation · this website
- bounty
- none today
revisions
The record of this page.
- revision 1
- 2026-11-01 · first full page: position, crosswalk, disclosure
- revision 0
- 2026-10-31 · four paragraphs pending the full page
Questions about security go to q@elementary.mu.