Trust · Certifications
Where we stand on every compliance framework.
We report certification status honestly. No certification has been awarded yet: SOC 2 Type II and ISO 27001 applications are planned, and GDPR practices are maintained today. We do not claim a certification before it is awarded.
Status
Compliance framework status
| Framework | Scope | Status | Target |
|---|---|---|---|
| SOC 2 Type II | Security, availability and confidentiality controls | Roadmap | Application planned |
| ISO 27001 | Information security management system (ISMS) | Roadmap | Application planned, after SOC 2 |
| UK & EU GDPR | UK GDPR / DPA 2018, and EU GDPR where it applies, for customer personal data | Compliant | Maintained continuously |
| PCI-DSS | Cardholder data: billing flows out of scope today; card issuance scope under review | Roadmap | Billing: no card data stored, payments run through our PSP. Card issuance (Remitgo, Q4 2026) will bring a defined PCI scope - issuing model under review |
Last reviewed: 22/08/2026. Statuses reflect plans and practices, not awarded certifications.
Approach
How we get there
- 1.Documented controls mapped to SOC 2 and ISO 27001 criteria, with named owners.
- 2.Continuous evidence collection across access reviews, change management and monitoring.
- 3.Independent assessment by a qualified third-party auditor, then annual surveillance.
Request a report
Enterprise customers and prospects can request our security questionnaire responses and control documentation under NDA. Email security@on8.ai with your company and use case.