US, EU, UK and Australia. Frameworks and where they come from.
The frameworks this is built from
The evidence requirements come from two frameworks we hold in full: ISO 27001:2022 and SOC 2. The four-market view names the regimes a business in each market may also face; where we do not hold a regime we name it and say so rather than state it.
The frameworks
ISO 27001:2022
licensed complete copy, 93 requirements held. Read the requirements or the framework as we hold it.
SOC 2
issuer free complete copy, 61 requirements held. Read the requirements or the framework as we hold it.
Primary sources and copyright
We state each requirement in our own words and cite its clause; we do not reproduce the standards verbatim. ISO 27001:2022 is published by the International Organization for Standardization; SOC 2 is published by the AICPA. We are not affiliated with, endorsed by or approved by either. Where we cite a public law or a free official source, we link it.
United States
Where a US framework genuinely applies we hold it; a US business handling card data or health data may also face PCI DSS or the HIPAA Security Rule, which we name here and do not quote where we do not hold the text.
European Union
GDPR and the EU AI Act may apply; we name them and link the official text rather than state a held clause we do not hold.
United Kingdom
UK GDPR and the ICO guidance may apply; named, not held.
Australia
The Privacy Act 1988 and the Notifiable Data Breaches scheme may apply; named, not held.