Trust centre
Where Qorionix stands on security and compliance today, and what we are committing to between now and general availability. This page exists so that procurement, security and compliance reviewers can answer “what has Qorionix actually done?” in under a minute.
Last reviewed
Compliance roadmap
Status, scope and timeline for every framework we map to. Dates are commitments rather than aspirations, and material slippage is disclosed on this page rather than quietly re-dated.
Active
Lawful-basis records, the subject-request workflow and one-call export, cascading erasure across every module, the breach-notification procedure, the architectural residency binding, and a published contact for data-protection questions that a person answers.
In effect. Reviewed as guidance evolves.
Planned
Data-processing agreements with customers and with each sub-processor, standard contractual clauses and the transfer safeguards that rest on them, and a contractual data-residency addendum. Each is executed by a legal person.
Blocked on the registration of the operating company, which is being formed. Nothing here has been signed. First commercial task after registration.
Active
A published policy with a three-business-day acknowledgement, remediation targets by severity, and safe harbour for good-faith research. A security.txt at the well-known path.
In effect. A bug-bounty programme with monetary rewards follows general availability.
Planned
Security, availability and confidentiality criteria across the identity, privileged access, log analysis and endpoint modules.
No assessor engaged. An engagement is a signed contract and follows the registration of the operating company. Report targeted before general availability.
Planned
The same control scope, demonstrated over a six-month observation window.
Observation window starts at general availability. Report targeted H1 2027.
Planned
Full management-system certification across people, process and technology.
Implementation H1 2027, stage 1 and stage 2 audits H2 2027.
Planned
Our own Article 21 risk-management framework, incident reporting and supply-chain security — the same obligations we help customers evidence.
Formalised alongside SOC 2 Type I.
Unresolved
A contractual guarantee that model inference runs inside the EU. Our provider does not currently offer one.
Unresolved. Until it is, the system card reports the inference region as unverified and the residency add-on is not sold.
Planned
Annual, plus before every major release. Red-team exercises semi-annually thereafter.
First engagement before general availability.
In place today
Not marketing language. Each of these maps to a specific control requirement, and three of them exist because we found the corresponding defect in our own code and fixed it structurally rather than patching the instance.
Governance
In the packet today, under mutual non-disclosure: our internal security policies, the architecture and data-flow description, the sub-processor list with regions, the encryption and key-management design, and the incident-response and breach-notification procedures.
Not in it, because it does not exist yet: a penetration-test report — the first engagement is before general availability, as the roadmap above says; a SOC 2 gap analysis or report, because no assessor is engaged; completed CAIQ or SIG-Lite questionnaires; a tested business-continuity plan; and executed sub-processor agreements, which are signed by a legal person and the operating company is being formed. We would rather you read that here than discover it on opening the envelope.
If you need one of those to complete a review, say which and we will tell you when it is expected rather than sending you something adjacent to it.
Email [email protected] with the subject [TRUST REQUEST]. We reply within one business day with the agreement and the packet.
If something on this page is not reflected in the trust packet you receive, tell us and we will correct the page.
No card. No sales call before you have read the report.