XBANQ GmbH · Trust Center

Control matrix — ISO 27001 · SOC 2 · DSGVO · EU AI Act · CRA · NIS2

Database records retrieved on 2026-09-23 · Neuhofer Weg 2, 91257 Pegnitz, Germany · hello@xbanq.com

XBANQ holds neither an ISO 27001 certificate nor a SOC 2 report. These are recorded statuses and evidence references, including initial seed records. They do not establish independent verification, complete framework coverage or audit readiness. Review dates are recorded values, not proof that evidence remains current.

Recorded status summary

FrameworkRecorded as implementedShare of recorded applicable controls
DSGVO / GDPR11/11100%
EU AI Act5/683%
ISO 2700136/4580%
SOC 218/2475%
CRA3/560%
NIS21/425%

ISO 27001:2022 (Annex A)

36/45 controls recorded as implemented · recorded statuses, not verified readiness

ControlTitle & descriptionStatusEvidenceLast reviewed
A.5.1 Policies for information security
A documented, living information-security policy set.
Implemented /compliance Trust Center + docs/SECURITY-AUDIT.md + the doctrine security baseline (§55). 2026-09-23 (recorded, not independently verified)
A.5.12 Classification of information
Information classified by sensitivity with handling rules per class.
Implemented Public-read vs staff-only vs service-role classes enforced per table via RLS (0021 §6; 0008/0015 law). 2026-09-23 (recorded, not independently verified)
A.5.14 Information transfer
Transfer rules for data in transit and to external parties.
Implemented TLS everywhere, CSP + HSTS (next.config.ts), no third-party scripts (audit §8). 2026-09-23 (recorded, not independently verified)
A.5.15 Access control
Access is granted on a need-to-know, least-privilege basis.
Implemented RLS on 36/36 tables verified in psql (audit §5); company/staff scoping per policy. 2026-09-23 (recorded, not independently verified)
A.5.16 Identity management
Identities are unique, managed, and cannot self-escalate.
Implemented Supabase Auth; guard_profile_escalation trigger blocks self-promotion (migration 0001). 2026-09-23 (recorded, not independently verified)
A.5.17 Authentication information
Secrets and credentials are protected across their lifecycle.
Implemented License keys stored as SHA-256 only; no plaintext secrets; no NEXT_PUBLIC secret vars (audit §4). 2026-09-23 (recorded, not independently verified)
A.5.18 Access rights
Access rights are provisioned, reviewed and revoked.
Implemented Server actions re-check requireStaff()/requireUser(); staff status read from the DB, never client claims. 2026-09-23 (recorded, not independently verified)
A.5.19 Information security in supplier relationships
Supplier risks are assessed and managed.
Partial Sub-processor list published in the AVV offer; formal supplier assessments pending scale. 2026-09-23 (recorded, not independently verified)
A.5.20 Addressing information security in supplier agreements
Agreements cover security duties of suppliers.
Implemented AVV offer (Art. 28 DSGVO) live on /compliance: sub-processors, measures, deletion, audit lanes. 2026-09-23 (recorded, not independently verified)
A.5.21 Managing information security in the ICT supply chain
Supply-chain risks of ICT products and services are managed.
Partial Dependencies pinned via lockfile; SBOM for CRA purposes still planned. 2026-09-23 (recorded, not independently verified)
A.5.23 Information security for use of cloud services
Cloud services are selected with security requirements and monitored.
Implemented Supabase EU region with RLS lockdown verified live (audit §5); Hetzner DE for the site. 2026-09-23 (recorded, not independently verified)
A.5.24 Incident management planning and preparation
Incident response is planned, with roles, timelines and documentation.
Implemented incident_log (0021) with severity, 72h authority deadline, containment/resolution lanes. 2026-09-23 (recorded, not independently verified)
A.5.25 Assessment and decision on security events
Events are assessed and classified as incidents.
Partial Incidents are recorded and classified on entry; automated event triage is not yet built. 2026-09-23 (recorded, not independently verified)
A.5.26 Response to information security incidents
Incidents are contained, resolved and learned from.
Implemented incident_log containment/resolution fields + notification state; honest empty log is the current truth. 2026-09-23 (recorded, not independently verified)
A.5.28 Collection of evidence
Evidence for audit and incident handling is collected and preserved.
Implemented audit_log append-only ledger (staff-gated) + consent_records evidence jsonb. 2026-09-23 (recorded, not independently verified)
A.5.29 Information security during disruption
Critical operations continue through disruption.
Partial Schema is fully reproducible from migrations (db reset); a formal, tested continuity plan is pending. 2026-09-23 (recorded, not independently verified)
A.5.31 Legal, statutory, regulatory and contractual requirements
Legal requirements are identified and compliance approached systematically.
Implemented This compliance engine: DSGVO, AI Act, CRA, NIS2 assessed and recorded as live controls (0021). 2026-09-23 (recorded, not independently verified)
A.5.32 Intellectual property rights
IP procedures are implemented.
Implemented Registered XBANQ® marks; Impressum with full register data (lib/site.ts). 2026-09-23 (recorded, not independently verified)
A.5.35 Independent review of information security
Security is independently reviewed on schedule.
Implemented Full live-probed security audit 2026-09-07 (docs/SECURITY-AUDIT.md): 24/24 routes, RLS, XSS fuzz, rate limits. 2026-09-23 (recorded, not independently verified)
A.5.36 Compliance with policies and standards
Compliance with the security policy set is verified.
Implemented Gate discipline: typecheck + lint + vitest (119-test security suite green, audit §7) before merge. 2026-09-23 (recorded, not independently verified)
A.5.37 Documented operating procedures
Operating procedures are documented and available.
Implemented Every migration and lib carries operating documentation in-file (0001-0021 headers, src/lib docs). 2026-09-23 (recorded, not independently verified)
A.5.9 Inventory of information and associated assets
Assets (here: data stores) are inventoried with owner, purpose and retention.
Implemented data_processing_records (migration 0021) — the live Art. 30 asset/data inventory. 2026-09-23 (recorded, not independently verified)
A.6.1 Screening
Personnel are screened prior to onboarding.
Partial Founder-led team with doctrine-bound access; formal background screening starts with hiring. 2026-09-23 (recorded, not independently verified)
A.6.3 Security awareness and education
Personnel are trained in security duties.
Partial Mandatory doctrine reading (§55 baseline) for every contributor; a formal training program is pending. 2026-09-23 (recorded, not independently verified)
A.6.7 Remote working
Security for remote work contexts.
Implemented No office dependency: service-role isolation, machine binding, per-install ids, signed updates. 2026-09-23 (recorded, not independently verified)
A.7.1 Physical security perimeters
Physical protection of facilities housing information systems.
Partial Hetzner data centers (certified operators) for servers; on-prem Mac Studio protected but not under formal zoning. 2026-09-23 (recorded, not independently verified)
A.8.1 User endpoint devices
Endpoints processing org data are protected.
Implemented XBANQ Pulse processes machine data locally, telemetry does not exist; minisign-signed updates only. 2026-09-23 (recorded, not independently verified)
A.8.10 Information deletion
Data is deleted per policy when no longer needed.
Implemented Self-serve account deletion (cascades profile, revokes licenses, retains invoices by law) + DSR erase lane. 2026-09-23 (recorded, not independently verified)
A.8.11 Data masking
Sensitive data is masked where full values are unnecessary.
Implemented License keys: hash + 4-char hint only; consent IPs stored as salted hashes (0021). 2026-09-23 (recorded, not independently verified)
A.8.12 Data leakage prevention
Data leakage channels are controlled.
Implemented No-secret-leak sentinel tests (tests/connectors.test.ts); secret naming law (audit §4). 2026-09-23 (recorded, not independently verified)
A.8.13 Information backup
Backups exist and are tested.
Partial Supabase managed backups + full migration reproducibility; a scheduled restore TEST is still to run. 2026-09-23 (recorded, not independently verified)
A.8.15 Logging
Events are logged, protected and reviewable.
Implemented audit_log (privileged actions, staff-gated) + ai_transparency_log + incident_log (0021). 2026-09-23 (recorded, not independently verified)
A.8.16 Monitoring activities
Systems and anomalies are monitored.
Implemented /api/health (live booleans), rate-limit lanes with live-probed 429s, audit feeds, admin stats. 2026-09-23 (recorded, not independently verified)
A.8.2 Privileged access rights
Privileged access is restricted and controlled.
Implemented Service-role client server-only behind audited actions; the key never reaches a browser (audit §1). 2026-09-23 (recorded, not independently verified)
A.8.20 Networks security
Networks are secured per policy.
Implemented CSP/HSTS/XFO DENY/Referrer-Policy, SSRF guards on git URLs, loopback-only local lanes (audit §3, §8). 2026-09-23 (recorded, not independently verified)
A.8.24 Use of cryptography
Cryptography is used per policy and standards.
Implemented SHA-256 key hashing, minisign release signatures, TLS for all transport. 2026-09-23 (recorded, not independently verified)
A.8.25 Secure development life cycle
Secure development rules are established and enforced.
Implemented Squad doctrine gates, injectable store tests, fuzz-tested renderers, review law (119-test security suite). 2026-09-23 (recorded, not independently verified)
A.8.27 Secure system architecture and engineering principles
Systems are built on secure engineering principles.
Implemented RLS-by-default on every table, server-side validation, tool-output isolation, agent permission boundaries. 2026-09-23 (recorded, not independently verified)
A.8.29 Security testing in development and acceptance
Security tests run in development and acceptance.
Implemented Vitest security suites (markdown fuzz, workspace traversal, rate limits) + live probe audits. 2026-09-23 (recorded, not independently verified)
A.8.3 Information access restriction
Access to information is restricted per policy.
Implemented RLS behavioral proof: anon sees the public catalog only; writes die at the GRANT level (audit §5). 2026-09-23 (recorded, not independently verified)
A.8.32 Change management
Changes are controlled, reviewed and traceable.
Implemented Migration discipline with per-migration ownership headers + git history per squad lane. 2026-09-23 (recorded, not independently verified)
A.8.5 Secure authentication
Authentication technologies are enforced per policy.
Implemented Supabase Auth sessions; the console uses one strictly necessary cookie; license verify is key-hash based. 2026-09-23 (recorded, not independently verified)
A.8.7 Protection against malware
Anti-malware protections on endpoints and delivery paths.
Implemented CSP default-src self, no third-party scripts, updates refuse unsigned artifacts (audit §8). 2026-09-23 (recorded, not independently verified)
A.8.8 Management of technical vulnerabilities
Vulnerabilities are identified and remediated on schedule.
Partial 2026-09-07 audit remediated all findings (F1-F8); automated dependency/secret scanning pipeline still to wire. 2026-09-23 (recorded, not independently verified)
A.8.9 Configuration management
Configurations are baseline-controlled and monitored.
Implemented Database as code (migrations 0001-0021), security headers in next.config.ts, IaC discipline. 2026-09-23 (recorded, not independently verified)

SOC 2 (Trust Services Criteria)

18/24 controls recorded as implemented · recorded statuses, not verified readiness

ControlTitle & descriptionStatusEvidenceLast reviewed
A1.1 Availability — infrastructure capacity
Capacity and availability of the service.
Partial Supabase-managed availability + Hetzner DE; no multi-region claim made today. 2026-09-23 (recorded, not independently verified)
A1.2 Recovery from disruptions
Recovery operations restore service.
Partial Migrations reproduce the full schema; documented recovery runbook still being formalized. 2026-09-23 (recorded, not independently verified)
A1.3 Recovery testing
Recovery is tested on schedule.
Planned Restore tests scheduled as part of the readiness program; none executed yet (honest gap). 2026-09-23 (recorded, not independently verified)
C1.1 Confidentiality commitments
Confidentiality commitments are identified and met.
Implemented AVV offer + staff-only data classes + no-tracking posture; commitments published and honored. 2026-09-23 (recorded, not independently verified)
CC1.2 Oversight and accountability
Management oversees the security program.
Implemented Founder mandate + doctrine §55 baseline; every product challengeable against MASTER-DOCTRINE. 2026-09-23 (recorded, not independently verified)
CC2.1 Relevant internal information
Security information is identified and communicated.
Implemented SECURITY-AUDIT.md + migration docs + the live /compliance Trust Center. 2026-09-23 (recorded, not independently verified)
CC2.3 Communication of objectives
Security objectives are communicated internally and externally.
Implemented Trust Center public statements; internal doctrine law; no claim beyond evidence. 2026-09-23 (recorded, not independently verified)
CC3.2 Risk assessment process
Risks are identified and analyzed on schedule.
Partial The 2026-09-07 audit is the first formal pass; a recurring risk register cadence is being established. 2026-09-23 (recorded, not independently verified)
CC3.3 Fraud risk assessment
Fraud risks are considered in the risk process.
Implemented Fraud lanes covered by the audit: license abuse (machine limits), payment fraud (Stripe), mail bombing (rate caps). 2026-09-23 (recorded, not independently verified)
CC4.1 Ongoing monitoring
Controls are monitored for effectiveness.
Implemented Live probes + unit gates + /api/health; findings tracked to fixed status (F1-F8). 2026-09-23 (recorded, not independently verified)
CC5.1 Risk mitigation controls
Controls mitigate identified risks.
Implemented RLS lockdown, rate limiting, hashing, sanitizers — all live-verified 2026-09-07. 2026-09-23 (recorded, not independently verified)
CC6.1 Logical access — restriction
Logical access is restricted to authorized users.
Implemented RLS 36/36 tables + 24/24 routes gated (audit §1, §5). 2026-09-23 (recorded, not independently verified)
CC6.3 Role-based access
Access roles are defined and enforced per function.
Implemented staff/member/owner roles with DB-enforced scoping; escalation blocked by trigger. 2026-09-23 (recorded, not independently verified)
CC6.5 Disposal of data
Data is disposed of per policy.
Implemented Account deletion cascade + retention rules per data_processing_records. 2026-09-23 (recorded, not independently verified)
CC6.6 External access threats
External access is protected against threats.
Implemented Origin guards, CSRF posture, SSRF/path defenses — all live-probed (audit §2, §8). 2026-09-23 (recorded, not independently verified)
CC6.7 Transmission of data
Data in transit is protected.
Implemented TLS + HSTS preload; no plaintext lanes; webhooks signature-verified. 2026-09-23 (recorded, not independently verified)
CC7.2 Anomaly detection
Anomalies are detected and acted on.
Partial Rate-limit lanes (429s live-proven) + audit feeds; ML-grade anomaly detection not claimed. 2026-09-23 (recorded, not independently verified)
CC7.3 Security incident evaluation
Events are evaluated to determine incidents.
Implemented incident_log classification on record: severity, affected-data flag, notification duty. 2026-09-23 (recorded, not independently verified)
CC7.4 Incident response
Incidents are responded to per plan.
Implemented incident_log with the 72h authority clock and containment/resolution lanes (0021). 2026-09-23 (recorded, not independently verified)
CC8.1 Change management
Changes are authorized, tested and approved.
Implemented Squad lanes + review law + gated migrations; no direct-to-prod writes. 2026-09-23 (recorded, not independently verified)
CC9.2 Vendor and business partner risk
Vendor risks are assessed and managed.
Partial Sub-processor list + AVV terms live; formal vendor risk reviews pending scale. 2026-09-23 (recorded, not independently verified)
P3.0 Choice and consent
Consent is obtained and honored per commitment.
Implemented Double opt-in newsletter + consent_records lifecycle (grant/withdraw, evidence) — 0021. 2026-09-23 (recorded, not independently verified)
P5.0 Access (data subject rights)
Subjects can access, rectify and erase their data.
Implemented DSR portal on /compliance + handlers (export/rectify/erase) + self-serve account deletion. 2026-09-23 (recorded, not independently verified)
P7.0 Retention and disposal
Data retention and disposal per policy.
Implemented Per-record retention in data_processing_records; statutory invoice retention documented. 2026-09-23 (recorded, not independently verified)

DSGVO / GDPR

11/11 controls recorded as implemented · recorded statuses, not verified readiness

ControlTitle & descriptionStatusEvidenceLast reviewed
ART-12 Transparent information
Subjects are informed plainly about processing and rights.
Implemented /compliance data map (live) + German canonical Datenschutz; one-email rights lane. 2026-09-23 (recorded, not independently verified)
ART-15-20 Data subject rights handlers
Access, rectification, erasure, restriction, portability, objection.
Implemented src/lib/compliance/dsr.ts: submit/export/rectify/erase handlers + the /compliance DSR portal. 2026-09-23 (recorded, not independently verified)
ART-25 Data protection by design and by default
Minimization and protection built into design.
Implemented RLS-first schema law, hashing instead of storing keys, per-record retention, service-role isolation. 2026-09-23 (recorded, not independently verified)
ART-28 Processor agreements (AVV)
AVV offered to company customers.
Implemented Countersignable AVV offer live on /compliance (5 working days). 2026-09-23 (recorded, not independently verified)
ART-30 Records of processing activities
The Art. 30 register exists and is current.
Implemented data_processing_records table — LIVE, seeded, public-read: this is the register. 2026-09-23 (recorded, not independently verified)
ART-32 Security of processing
Technical and organizational measures.
Implemented §04 of the Trust Center + audit F1-F8: RLS, hashing, rate limits, headers, sanitizers — live-probed. 2026-09-23 (recorded, not independently verified)
ART-33-34 Breach notification
72h authority notification, affected-subject notification.
Implemented incident_log with computed 72h deadline + affected_data + notified flags (0021). 2026-09-23 (recorded, not independently verified)
ART-44-49 International transfers
Transfers outside the EU only with safeguards.
Implemented transfer_outside_eu=false across the register; EU-region hosting; AVV sub-processor terms. 2026-09-23 (recorded, not independently verified)
ART-5 Principles relating to processing
Lawfulness, fairness, transparency, purpose limitation, minimization, integrity.
Implemented No tracking/analytics/ads; purpose per record live in data_processing_records. 2026-09-23 (recorded, not independently verified)
ART-6 Lawfulness of processing
Every processing activity has a documented legal basis.
Implemented legal_basis column (constrained to the six Art. 6(1) bases) on every record — queryable. 2026-09-23 (recorded, not independently verified)
ART-7 Conditions for consent
Consent is demonstrable, freely given, withdrawable.
Implemented consent_records: full lifecycle + double-opt-in evidence + salted IP hash (0021). 2026-09-23 (recorded, not independently verified)

EU AI Act

5/6 controls recorded as implemented · recorded statuses, not verified readiness

ControlTitle & descriptionStatusEvidenceLast reviewed
ART-10 Data and AI governance
Data used for AI is governed (quality, relevance).
Partial Growth engine zeros-law (no fabricated state); formal training-data governance pending model work. 2026-09-23 (recorded, not independently verified)
ART-14 Human oversight
Consequential AI actions require human approval.
Implemented The approvals gate: nothing auto-posts; every candidate routes through a human decision. 2026-09-23 (recorded, not independently verified)
ART-5 Prohibited practices
No prohibited AI practices (biometric categorization, social scoring, emotion inference at work).
Implemented Stated commitment; no such systems exist in any XBANQ product. 2026-09-23 (recorded, not independently verified)
ART-50.1 Disclosure of AI interaction
Users are told when they interact with an AI system.
Implemented The console chat surfaces its agent nature in the interface; disclosure_shown logged per entry. 2026-09-23 (recorded, not independently verified)
ART-50.2 Machine-readable provenance of synthetic content
AI-generated content is detectable and its provenance recorded.
Implemented ai_transparency_log: one row per generated piece (content_type, model, provider) — auto-written. 2026-09-23 (recorded, not independently verified)
RISK-REG Risk classification register
Systems are classified per AI Act risk tiers.
Implemented Transparency-first posture: all XBANQ AI surfaces are limited-risk (disclosure duties), documented per system. 2026-09-23 (recorded, not independently verified)

Cyber Resilience Act (CRA)

3/5 controls recorded as implemented · recorded statuses, not verified readiness

ControlTitle & descriptionStatusEvidenceLast reviewed
CRA-1 Vulnerability handling processes
A process to receive, triage and remediate vulnerability reports.
Partial hello@ channel + audit discipline; a published coordinated-disclosure policy is in preparation. 2026-09-23 (recorded, not independently verified)
CRA-2 Secure updates
Products receive security updates, delivered safely.
Implemented minisign-signed release artifacts; the updater refuses anything unsigned. 2026-09-23 (recorded, not independently verified)
CRA-3 SBOM
A software bill of materials for products with digital elements.
Planned SBOM generation scheduled with the CRA product-security duties; not yet produced (honest gap). 2026-09-23 (recorded, not independently verified)
CRA-4 Vulnerability and incident reporting
Actively-exploited vulnerabilities and severe incidents reported to ENISA/CSIRT on time.
Implemented incident_log carries detection→deadline lanes compatible with the CRA 24h/72h reporting clocks. 2026-09-23 (recorded, not independently verified)
CRA-5 Secure development
Products developed per secure-by-design principles.
Implemented The audit discipline itself: 24/24 route gates, traversal/injection walls, fuzz-tested renderers. 2026-09-23 (recorded, not independently verified)

NIS2

1/4 controls recorded as implemented · recorded statuses, not verified readiness

ControlTitle & descriptionStatusEvidenceLast reviewed
NIS2-1 Risk-management measures
Art. 21 risk-management: identification, protection, detection, response.
Partial Technical measures verified live (audit F1-F8); the formal Article 21 register is being compiled. 2026-09-23 (recorded, not independently verified)
NIS2-2 Incident reporting timelines
24h early warning, 72h notification, 1-month final report.
Implemented incident_log notification_deadline (72h) + engine-computed NIS2 early-warning due (24h). 2026-09-23 (recorded, not independently verified)
NIS2-3 Supply-chain security
Supplier relationships are secured.
Partial AVV terms + pinned dependencies; formal supply-chain assessments pending. 2026-09-23 (recorded, not independently verified)
NIS2-4 Business continuity and crisis management
Continuity plans including backup and crisis management.
Partial Migration-based reproducibility + managed backups; tested continuity plan pending. 2026-09-23 (recorded, not independently verified)

End of matrix · 2026-09-23 · XBANQ GmbH