Compliance
Last updated 2026-09-01
Avieros holds no third-party security or compliance certification. No SOC 2, no ISO 27001, no HIPAA attestation, no PCI attestation of its own, no independent penetration test. That is the whole answer, and it is the first line on this page rather than a footnote at the bottom of one.
Claiming a certification before the audit is the kind of lie that ends companies, and the kind that is trivially caught: an auditor’s report either exists or it does not. So this page is arranged as a ledger — each item, its real state, and what would have to happen for that state to change.
The ledger
| Item | State | What would change it |
|---|---|---|
| SOC 2 (Type I or II) | Not held. No audit has been commissioned, no observation window has run, and there is no report. | An accredited auditor, an observation period, and a report we could show you. None of that has started. |
| ISO 27001 | Not held. No certification body has been engaged. | A certified ISMS and an external audit. |
| HIPAA | Not held, and not applicable today. Avieros does not offer a BAA and should not be used for protected health information. | A BAA and the controls behind it. Until then, treat PHI as out of scope. |
| PCI DSS | Not held, and not currently relevant. Payment processing is switched off entirely; card data has never touched Avieros infrastructure, because payment handling is delegated to a processor rather than built here. | Enabling payments, which would make the processor’s attestation the relevant one, not ours. |
| Independent penetration test | None commissioned. There is no report to summarise, so none is summarised. | Engaging a firm and publishing at least the summary. |
| GDPR posture | Partially addressed, honestly. Subprocessors are enumerated and data-subject rights are self-serve and working. There is no signed DPA or SCC pack to hand a DPO. | See Subprocessors, which states the same gap in the same words. |
| Data-subject rights (access, export, correction, deletion) | Live and self-serve today. This is the one row on this page that is a yes. | Nothing — use it at avieros.com/data-rights. |
What exists instead
A certification is an outside party attesting that controls exist and are followed. Avieros has no such attestation. What it has is the controls themselves, stated specifically enough that you can check them without taking anyone’s word — including the parts that are not covered:
- Row-level security on 545 of 545 production tables, counted from the live database, with cross-tenant checks in CI that are themselves proven able to fail. One open exception is named on the Security page.
- Secret scanning over the full repository history, plus a separate check for credentials that would ship inside a browser bundle.
- A written incident plan with a severity ladder, a containment-first first move, and a counsel gate on notification — including which of its containment controls is not yet verified.
- Every commitment on this site paired with the mechanism that enforces it, or marked as merely declared. See the overview.
None of that is a substitute for an audit. It is offered as what it is: verifiable specifics from an uncertified platform, which is a different and more checkable claim than a badge.
Then Avieros does not currently meet it, and no amount of this page will change that. That is the honest answer to give a buyer up front rather than three weeks into a security review. Questions: legal@avieros.com.
Back This site runs no script, so it cannot know where you came from and will not pretend to. The Trust Center overview is here.