Back to homepage
Trust
Compliance roadmap
Bstrapr does not claim SOC 2, ISO, or audit packaging today. Access activity history is operational — not a formal compliance control. This page is the dated intent for independent validation.
- Now: public security architecture, disclosure policy, and data-location clarity
- Next: third-party penetration test of control plane, helper, and enrollment — publish executive summary when complete
- Then: SOC 2 Type I evaluation with a target window once customer demand and Dedicated scope justify it
- Later: SOC 2 Type II after a sustained observation period
| Milestone | Target window | Status |
|---|---|---|
| Security whitepaper + data-location table | Done (2026-11-01) | Published on /security — including tenant isolation & AI workspace flow |
| security.txt + disclosure policy | Done (2026-11-01) | Published at /.well-known/security.txt and /security/disclosure |
| Homepage trust & pricing clarity | Done (2026-11-01) | Plan terms, overages, comparison a11y, footer trust links |
| Third-party pen-test summary | 2027 H1 (or sooner if commissioned) | Not started — largest unlock toward a 9; will publish when done |
| SOC 2 Type I | 2027 (demand-driven) | Planned; accelerate under Dedicated |
| SOC 2 Type II | After Type I observation | Planned |
| Named customer / design-partner case study | Ongoing | None published yet |
| Named founder bios on /about | Ongoing | Not published yet — will not invent |
Need evidence sooner for a procurement process? Ask about a Dedicated control plane and a scoped assessment under that deployment.