Trust, shown with evidence

Four things a security review asks for that we cannot answer with a certificate. Each one says what is actually operating today, then states the limitation in the terms you would use yourself. The second half is never the smaller half.

• An ISO 27001 and SOC 2 programme, running and mapped control by controlThe policies, the controls with their stated cadences, the audit programme, the register of times a control was not working, and the management review all exist and are on this site. Each control is mapped to the specific ISO 27001 Annex A control and SOC 2 Common Criteria it serves, and that mapping goes to your security team on request.Neither standard has been externally audited, so there is no certificate to send you and we will not imply one with a badge. What you can check is the mapping and the evidence behind each control.
• Adversarial testing that runs against this platform continuouslyWe run structured adversarial assessments and remediate what they find, and a daily automated sweep checks the database's access controls and fails loudly rather than quietly. The testing summary goes to your security team with the security pack.That testing has been ours rather than a third party's, which is weaker assurance than an external test, and we would rather say so than let the word testing imply otherwise. An independent penetration test is on the roadmap.
• Cyber insurance bound before any of your students are in the systemQuotes are in progress, and the trigger is written into the Pilot Terms rather than promised in a conversation: certificates of currency are provided before the first pilot with real students begins.No policy is in force today.
• Backups that have been restored, not just takenDaily managed snapshots, plus a daily off-site backup encrypted to a key held offline and ageing out within 30 days. It is drilled rather than assumed: a full end-to-end restore on 27 July 2026 came back complete and reconciled row for row against production.Recovery to an arbitrary moment, point-in-time recovery, is a paid database tier we have not taken yet, so today's worst-case recovery point is the last daily backup rather than the last few minutes. It is enabled at the first paying engagement.

A green dot means the control is operating and reviewed on its stated frequency. An amber dot means it is documented and scheduled but has not run yet — we mark those rather than hide them.