XBANQ GmbH · Trust Center
Control matrix — ISO 27001 · SOC 2 · DSGVO · EU AI Act · CRA · NIS2
Database records retrieved on 2026-09-23 · Neuhofer Weg 2, 91257 Pegnitz, Germany · hello@xbanq.com
XBANQ holds neither an ISO 27001 certificate nor a SOC 2 report. These are recorded statuses and evidence references, including initial seed records. They do not establish independent verification, complete framework coverage or audit readiness. Review dates are recorded values, not proof that evidence remains current.
Recorded status summary
| Framework | Recorded as implemented | Share of recorded applicable controls |
|---|---|---|
| DSGVO / GDPR | 11/11 | 100% |
| EU AI Act | 5/6 | 83% |
| ISO 27001 | 36/45 | 80% |
| SOC 2 | 18/24 | 75% |
| CRA | 3/5 | 60% |
| NIS2 | 1/4 | 25% |
ISO 27001:2022 (Annex A)
36/45 controls recorded as implemented · recorded statuses, not verified readiness
| Control | Title & description | Status | Evidence | Last reviewed |
|---|---|---|---|---|
| A.5.1 | Policies for information security A documented, living information-security policy set. |
Implemented | /compliance Trust Center + docs/SECURITY-AUDIT.md + the doctrine security baseline (§55). | 2026-09-23 (recorded, not independently verified) |
| A.5.12 | Classification of information Information classified by sensitivity with handling rules per class. |
Implemented | Public-read vs staff-only vs service-role classes enforced per table via RLS (0021 §6; 0008/0015 law). | 2026-09-23 (recorded, not independently verified) |
| A.5.14 | Information transfer Transfer rules for data in transit and to external parties. |
Implemented | TLS everywhere, CSP + HSTS (next.config.ts), no third-party scripts (audit §8). | 2026-09-23 (recorded, not independently verified) |
| A.5.15 | Access control Access is granted on a need-to-know, least-privilege basis. |
Implemented | RLS on 36/36 tables verified in psql (audit §5); company/staff scoping per policy. | 2026-09-23 (recorded, not independently verified) |
| A.5.16 | Identity management Identities are unique, managed, and cannot self-escalate. |
Implemented | Supabase Auth; guard_profile_escalation trigger blocks self-promotion (migration 0001). | 2026-09-23 (recorded, not independently verified) |
| A.5.17 | Authentication information Secrets and credentials are protected across their lifecycle. |
Implemented | License keys stored as SHA-256 only; no plaintext secrets; no NEXT_PUBLIC secret vars (audit §4). | 2026-09-23 (recorded, not independently verified) |
| A.5.18 | Access rights Access rights are provisioned, reviewed and revoked. |
Implemented | Server actions re-check requireStaff()/requireUser(); staff status read from the DB, never client claims. | 2026-09-23 (recorded, not independently verified) |
| A.5.19 | Information security in supplier relationships Supplier risks are assessed and managed. |
Partial | Sub-processor list published in the AVV offer; formal supplier assessments pending scale. | 2026-09-23 (recorded, not independently verified) |
| A.5.20 | Addressing information security in supplier agreements Agreements cover security duties of suppliers. |
Implemented | AVV offer (Art. 28 DSGVO) live on /compliance: sub-processors, measures, deletion, audit lanes. | 2026-09-23 (recorded, not independently verified) |
| A.5.21 | Managing information security in the ICT supply chain Supply-chain risks of ICT products and services are managed. |
Partial | Dependencies pinned via lockfile; SBOM for CRA purposes still planned. | 2026-09-23 (recorded, not independently verified) |
| A.5.23 | Information security for use of cloud services Cloud services are selected with security requirements and monitored. |
Implemented | Supabase EU region with RLS lockdown verified live (audit §5); Hetzner DE for the site. | 2026-09-23 (recorded, not independently verified) |
| A.5.24 | Incident management planning and preparation Incident response is planned, with roles, timelines and documentation. |
Implemented | incident_log (0021) with severity, 72h authority deadline, containment/resolution lanes. | 2026-09-23 (recorded, not independently verified) |
| A.5.25 | Assessment and decision on security events Events are assessed and classified as incidents. |
Partial | Incidents are recorded and classified on entry; automated event triage is not yet built. | 2026-09-23 (recorded, not independently verified) |
| A.5.26 | Response to information security incidents Incidents are contained, resolved and learned from. |
Implemented | incident_log containment/resolution fields + notification state; honest empty log is the current truth. | 2026-09-23 (recorded, not independently verified) |
| A.5.28 | Collection of evidence Evidence for audit and incident handling is collected and preserved. |
Implemented | audit_log append-only ledger (staff-gated) + consent_records evidence jsonb. | 2026-09-23 (recorded, not independently verified) |
| A.5.29 | Information security during disruption Critical operations continue through disruption. |
Partial | Schema is fully reproducible from migrations (db reset); a formal, tested continuity plan is pending. | 2026-09-23 (recorded, not independently verified) |
| A.5.31 | Legal, statutory, regulatory and contractual requirements Legal requirements are identified and compliance approached systematically. |
Implemented | This compliance engine: DSGVO, AI Act, CRA, NIS2 assessed and recorded as live controls (0021). | 2026-09-23 (recorded, not independently verified) |
| A.5.32 | Intellectual property rights IP procedures are implemented. |
Implemented | Registered XBANQ® marks; Impressum with full register data (lib/site.ts). | 2026-09-23 (recorded, not independently verified) |
| A.5.35 | Independent review of information security Security is independently reviewed on schedule. |
Implemented | Full live-probed security audit 2026-09-07 (docs/SECURITY-AUDIT.md): 24/24 routes, RLS, XSS fuzz, rate limits. | 2026-09-23 (recorded, not independently verified) |
| A.5.36 | Compliance with policies and standards Compliance with the security policy set is verified. |
Implemented | Gate discipline: typecheck + lint + vitest (119-test security suite green, audit §7) before merge. | 2026-09-23 (recorded, not independently verified) |
| A.5.37 | Documented operating procedures Operating procedures are documented and available. |
Implemented | Every migration and lib carries operating documentation in-file (0001-0021 headers, src/lib docs). | 2026-09-23 (recorded, not independently verified) |
| A.5.9 | Inventory of information and associated assets Assets (here: data stores) are inventoried with owner, purpose and retention. |
Implemented | data_processing_records (migration 0021) — the live Art. 30 asset/data inventory. | 2026-09-23 (recorded, not independently verified) |
| A.6.1 | Screening Personnel are screened prior to onboarding. |
Partial | Founder-led team with doctrine-bound access; formal background screening starts with hiring. | 2026-09-23 (recorded, not independently verified) |
| A.6.3 | Security awareness and education Personnel are trained in security duties. |
Partial | Mandatory doctrine reading (§55 baseline) for every contributor; a formal training program is pending. | 2026-09-23 (recorded, not independently verified) |
| A.6.7 | Remote working Security for remote work contexts. |
Implemented | No office dependency: service-role isolation, machine binding, per-install ids, signed updates. | 2026-09-23 (recorded, not independently verified) |
| A.7.1 | Physical security perimeters Physical protection of facilities housing information systems. |
Partial | Hetzner data centers (certified operators) for servers; on-prem Mac Studio protected but not under formal zoning. | 2026-09-23 (recorded, not independently verified) |
| A.8.1 | User endpoint devices Endpoints processing org data are protected. |
Implemented | XBANQ Pulse processes machine data locally, telemetry does not exist; minisign-signed updates only. | 2026-09-23 (recorded, not independently verified) |
| A.8.10 | Information deletion Data is deleted per policy when no longer needed. |
Implemented | Self-serve account deletion (cascades profile, revokes licenses, retains invoices by law) + DSR erase lane. | 2026-09-23 (recorded, not independently verified) |
| A.8.11 | Data masking Sensitive data is masked where full values are unnecessary. |
Implemented | License keys: hash + 4-char hint only; consent IPs stored as salted hashes (0021). | 2026-09-23 (recorded, not independently verified) |
| A.8.12 | Data leakage prevention Data leakage channels are controlled. |
Implemented | No-secret-leak sentinel tests (tests/connectors.test.ts); secret naming law (audit §4). | 2026-09-23 (recorded, not independently verified) |
| A.8.13 | Information backup Backups exist and are tested. |
Partial | Supabase managed backups + full migration reproducibility; a scheduled restore TEST is still to run. | 2026-09-23 (recorded, not independently verified) |
| A.8.15 | Logging Events are logged, protected and reviewable. |
Implemented | audit_log (privileged actions, staff-gated) + ai_transparency_log + incident_log (0021). | 2026-09-23 (recorded, not independently verified) |
| A.8.16 | Monitoring activities Systems and anomalies are monitored. |
Implemented | /api/health (live booleans), rate-limit lanes with live-probed 429s, audit feeds, admin stats. | 2026-09-23 (recorded, not independently verified) |
| A.8.2 | Privileged access rights Privileged access is restricted and controlled. |
Implemented | Service-role client server-only behind audited actions; the key never reaches a browser (audit §1). | 2026-09-23 (recorded, not independently verified) |
| A.8.20 | Networks security Networks are secured per policy. |
Implemented | CSP/HSTS/XFO DENY/Referrer-Policy, SSRF guards on git URLs, loopback-only local lanes (audit §3, §8). | 2026-09-23 (recorded, not independently verified) |
| A.8.24 | Use of cryptography Cryptography is used per policy and standards. |
Implemented | SHA-256 key hashing, minisign release signatures, TLS for all transport. | 2026-09-23 (recorded, not independently verified) |
| A.8.25 | Secure development life cycle Secure development rules are established and enforced. |
Implemented | Squad doctrine gates, injectable store tests, fuzz-tested renderers, review law (119-test security suite). | 2026-09-23 (recorded, not independently verified) |
| A.8.27 | Secure system architecture and engineering principles Systems are built on secure engineering principles. |
Implemented | RLS-by-default on every table, server-side validation, tool-output isolation, agent permission boundaries. | 2026-09-23 (recorded, not independently verified) |
| A.8.29 | Security testing in development and acceptance Security tests run in development and acceptance. |
Implemented | Vitest security suites (markdown fuzz, workspace traversal, rate limits) + live probe audits. | 2026-09-23 (recorded, not independently verified) |
| A.8.3 | Information access restriction Access to information is restricted per policy. |
Implemented | RLS behavioral proof: anon sees the public catalog only; writes die at the GRANT level (audit §5). | 2026-09-23 (recorded, not independently verified) |
| A.8.32 | Change management Changes are controlled, reviewed and traceable. |
Implemented | Migration discipline with per-migration ownership headers + git history per squad lane. | 2026-09-23 (recorded, not independently verified) |
| A.8.5 | Secure authentication Authentication technologies are enforced per policy. |
Implemented | Supabase Auth sessions; the console uses one strictly necessary cookie; license verify is key-hash based. | 2026-09-23 (recorded, not independently verified) |
| A.8.7 | Protection against malware Anti-malware protections on endpoints and delivery paths. |
Implemented | CSP default-src self, no third-party scripts, updates refuse unsigned artifacts (audit §8). | 2026-09-23 (recorded, not independently verified) |
| A.8.8 | Management of technical vulnerabilities Vulnerabilities are identified and remediated on schedule. |
Partial | 2026-09-07 audit remediated all findings (F1-F8); automated dependency/secret scanning pipeline still to wire. | 2026-09-23 (recorded, not independently verified) |
| A.8.9 | Configuration management Configurations are baseline-controlled and monitored. |
Implemented | Database as code (migrations 0001-0021), security headers in next.config.ts, IaC discipline. | 2026-09-23 (recorded, not independently verified) |
SOC 2 (Trust Services Criteria)
18/24 controls recorded as implemented · recorded statuses, not verified readiness
| Control | Title & description | Status | Evidence | Last reviewed |
|---|---|---|---|---|
| A1.1 | Availability — infrastructure capacity Capacity and availability of the service. |
Partial | Supabase-managed availability + Hetzner DE; no multi-region claim made today. | 2026-09-23 (recorded, not independently verified) |
| A1.2 | Recovery from disruptions Recovery operations restore service. |
Partial | Migrations reproduce the full schema; documented recovery runbook still being formalized. | 2026-09-23 (recorded, not independently verified) |
| A1.3 | Recovery testing Recovery is tested on schedule. |
Planned | Restore tests scheduled as part of the readiness program; none executed yet (honest gap). | 2026-09-23 (recorded, not independently verified) |
| C1.1 | Confidentiality commitments Confidentiality commitments are identified and met. |
Implemented | AVV offer + staff-only data classes + no-tracking posture; commitments published and honored. | 2026-09-23 (recorded, not independently verified) |
| CC1.2 | Oversight and accountability Management oversees the security program. |
Implemented | Founder mandate + doctrine §55 baseline; every product challengeable against MASTER-DOCTRINE. | 2026-09-23 (recorded, not independently verified) |
| CC2.1 | Relevant internal information Security information is identified and communicated. |
Implemented | SECURITY-AUDIT.md + migration docs + the live /compliance Trust Center. | 2026-09-23 (recorded, not independently verified) |
| CC2.3 | Communication of objectives Security objectives are communicated internally and externally. |
Implemented | Trust Center public statements; internal doctrine law; no claim beyond evidence. | 2026-09-23 (recorded, not independently verified) |
| CC3.2 | Risk assessment process Risks are identified and analyzed on schedule. |
Partial | The 2026-09-07 audit is the first formal pass; a recurring risk register cadence is being established. | 2026-09-23 (recorded, not independently verified) |
| CC3.3 | Fraud risk assessment Fraud risks are considered in the risk process. |
Implemented | Fraud lanes covered by the audit: license abuse (machine limits), payment fraud (Stripe), mail bombing (rate caps). | 2026-09-23 (recorded, not independently verified) |
| CC4.1 | Ongoing monitoring Controls are monitored for effectiveness. |
Implemented | Live probes + unit gates + /api/health; findings tracked to fixed status (F1-F8). | 2026-09-23 (recorded, not independently verified) |
| CC5.1 | Risk mitigation controls Controls mitigate identified risks. |
Implemented | RLS lockdown, rate limiting, hashing, sanitizers — all live-verified 2026-09-07. | 2026-09-23 (recorded, not independently verified) |
| CC6.1 | Logical access — restriction Logical access is restricted to authorized users. |
Implemented | RLS 36/36 tables + 24/24 routes gated (audit §1, §5). | 2026-09-23 (recorded, not independently verified) |
| CC6.3 | Role-based access Access roles are defined and enforced per function. |
Implemented | staff/member/owner roles with DB-enforced scoping; escalation blocked by trigger. | 2026-09-23 (recorded, not independently verified) |
| CC6.5 | Disposal of data Data is disposed of per policy. |
Implemented | Account deletion cascade + retention rules per data_processing_records. | 2026-09-23 (recorded, not independently verified) |
| CC6.6 | External access threats External access is protected against threats. |
Implemented | Origin guards, CSRF posture, SSRF/path defenses — all live-probed (audit §2, §8). | 2026-09-23 (recorded, not independently verified) |
| CC6.7 | Transmission of data Data in transit is protected. |
Implemented | TLS + HSTS preload; no plaintext lanes; webhooks signature-verified. | 2026-09-23 (recorded, not independently verified) |
| CC7.2 | Anomaly detection Anomalies are detected and acted on. |
Partial | Rate-limit lanes (429s live-proven) + audit feeds; ML-grade anomaly detection not claimed. | 2026-09-23 (recorded, not independently verified) |
| CC7.3 | Security incident evaluation Events are evaluated to determine incidents. |
Implemented | incident_log classification on record: severity, affected-data flag, notification duty. | 2026-09-23 (recorded, not independently verified) |
| CC7.4 | Incident response Incidents are responded to per plan. |
Implemented | incident_log with the 72h authority clock and containment/resolution lanes (0021). | 2026-09-23 (recorded, not independently verified) |
| CC8.1 | Change management Changes are authorized, tested and approved. |
Implemented | Squad lanes + review law + gated migrations; no direct-to-prod writes. | 2026-09-23 (recorded, not independently verified) |
| CC9.2 | Vendor and business partner risk Vendor risks are assessed and managed. |
Partial | Sub-processor list + AVV terms live; formal vendor risk reviews pending scale. | 2026-09-23 (recorded, not independently verified) |
| P3.0 | Choice and consent Consent is obtained and honored per commitment. |
Implemented | Double opt-in newsletter + consent_records lifecycle (grant/withdraw, evidence) — 0021. | 2026-09-23 (recorded, not independently verified) |
| P5.0 | Access (data subject rights) Subjects can access, rectify and erase their data. |
Implemented | DSR portal on /compliance + handlers (export/rectify/erase) + self-serve account deletion. | 2026-09-23 (recorded, not independently verified) |
| P7.0 | Retention and disposal Data retention and disposal per policy. |
Implemented | Per-record retention in data_processing_records; statutory invoice retention documented. | 2026-09-23 (recorded, not independently verified) |
DSGVO / GDPR
11/11 controls recorded as implemented · recorded statuses, not verified readiness
| Control | Title & description | Status | Evidence | Last reviewed |
|---|---|---|---|---|
| ART-12 | Transparent information Subjects are informed plainly about processing and rights. |
Implemented | /compliance data map (live) + German canonical Datenschutz; one-email rights lane. | 2026-09-23 (recorded, not independently verified) |
| ART-15-20 | Data subject rights handlers Access, rectification, erasure, restriction, portability, objection. |
Implemented | src/lib/compliance/dsr.ts: submit/export/rectify/erase handlers + the /compliance DSR portal. | 2026-09-23 (recorded, not independently verified) |
| ART-25 | Data protection by design and by default Minimization and protection built into design. |
Implemented | RLS-first schema law, hashing instead of storing keys, per-record retention, service-role isolation. | 2026-09-23 (recorded, not independently verified) |
| ART-28 | Processor agreements (AVV) AVV offered to company customers. |
Implemented | Countersignable AVV offer live on /compliance (5 working days). | 2026-09-23 (recorded, not independently verified) |
| ART-30 | Records of processing activities The Art. 30 register exists and is current. |
Implemented | data_processing_records table — LIVE, seeded, public-read: this is the register. | 2026-09-23 (recorded, not independently verified) |
| ART-32 | Security of processing Technical and organizational measures. |
Implemented | §04 of the Trust Center + audit F1-F8: RLS, hashing, rate limits, headers, sanitizers — live-probed. | 2026-09-23 (recorded, not independently verified) |
| ART-33-34 | Breach notification 72h authority notification, affected-subject notification. |
Implemented | incident_log with computed 72h deadline + affected_data + notified flags (0021). | 2026-09-23 (recorded, not independently verified) |
| ART-44-49 | International transfers Transfers outside the EU only with safeguards. |
Implemented | transfer_outside_eu=false across the register; EU-region hosting; AVV sub-processor terms. | 2026-09-23 (recorded, not independently verified) |
| ART-5 | Principles relating to processing Lawfulness, fairness, transparency, purpose limitation, minimization, integrity. |
Implemented | No tracking/analytics/ads; purpose per record live in data_processing_records. | 2026-09-23 (recorded, not independently verified) |
| ART-6 | Lawfulness of processing Every processing activity has a documented legal basis. |
Implemented | legal_basis column (constrained to the six Art. 6(1) bases) on every record — queryable. | 2026-09-23 (recorded, not independently verified) |
| ART-7 | Conditions for consent Consent is demonstrable, freely given, withdrawable. |
Implemented | consent_records: full lifecycle + double-opt-in evidence + salted IP hash (0021). | 2026-09-23 (recorded, not independently verified) |
EU AI Act
5/6 controls recorded as implemented · recorded statuses, not verified readiness
| Control | Title & description | Status | Evidence | Last reviewed |
|---|---|---|---|---|
| ART-10 | Data and AI governance Data used for AI is governed (quality, relevance). |
Partial | Growth engine zeros-law (no fabricated state); formal training-data governance pending model work. | 2026-09-23 (recorded, not independently verified) |
| ART-14 | Human oversight Consequential AI actions require human approval. |
Implemented | The approvals gate: nothing auto-posts; every candidate routes through a human decision. | 2026-09-23 (recorded, not independently verified) |
| ART-5 | Prohibited practices No prohibited AI practices (biometric categorization, social scoring, emotion inference at work). |
Implemented | Stated commitment; no such systems exist in any XBANQ product. | 2026-09-23 (recorded, not independently verified) |
| ART-50.1 | Disclosure of AI interaction Users are told when they interact with an AI system. |
Implemented | The console chat surfaces its agent nature in the interface; disclosure_shown logged per entry. | 2026-09-23 (recorded, not independently verified) |
| ART-50.2 | Machine-readable provenance of synthetic content AI-generated content is detectable and its provenance recorded. |
Implemented | ai_transparency_log: one row per generated piece (content_type, model, provider) — auto-written. | 2026-09-23 (recorded, not independently verified) |
| RISK-REG | Risk classification register Systems are classified per AI Act risk tiers. |
Implemented | Transparency-first posture: all XBANQ AI surfaces are limited-risk (disclosure duties), documented per system. | 2026-09-23 (recorded, not independently verified) |
Cyber Resilience Act (CRA)
3/5 controls recorded as implemented · recorded statuses, not verified readiness
| Control | Title & description | Status | Evidence | Last reviewed |
|---|---|---|---|---|
| CRA-1 | Vulnerability handling processes A process to receive, triage and remediate vulnerability reports. |
Partial | hello@ channel + audit discipline; a published coordinated-disclosure policy is in preparation. | 2026-09-23 (recorded, not independently verified) |
| CRA-2 | Secure updates Products receive security updates, delivered safely. |
Implemented | minisign-signed release artifacts; the updater refuses anything unsigned. | 2026-09-23 (recorded, not independently verified) |
| CRA-3 | SBOM A software bill of materials for products with digital elements. |
Planned | SBOM generation scheduled with the CRA product-security duties; not yet produced (honest gap). | 2026-09-23 (recorded, not independently verified) |
| CRA-4 | Vulnerability and incident reporting Actively-exploited vulnerabilities and severe incidents reported to ENISA/CSIRT on time. |
Implemented | incident_log carries detection→deadline lanes compatible with the CRA 24h/72h reporting clocks. | 2026-09-23 (recorded, not independently verified) |
| CRA-5 | Secure development Products developed per secure-by-design principles. |
Implemented | The audit discipline itself: 24/24 route gates, traversal/injection walls, fuzz-tested renderers. | 2026-09-23 (recorded, not independently verified) |
NIS2
1/4 controls recorded as implemented · recorded statuses, not verified readiness
| Control | Title & description | Status | Evidence | Last reviewed |
|---|---|---|---|---|
| NIS2-1 | Risk-management measures Art. 21 risk-management: identification, protection, detection, response. |
Partial | Technical measures verified live (audit F1-F8); the formal Article 21 register is being compiled. | 2026-09-23 (recorded, not independently verified) |
| NIS2-2 | Incident reporting timelines 24h early warning, 72h notification, 1-month final report. |
Implemented | incident_log notification_deadline (72h) + engine-computed NIS2 early-warning due (24h). | 2026-09-23 (recorded, not independently verified) |
| NIS2-3 | Supply-chain security Supplier relationships are secured. |
Partial | AVV terms + pinned dependencies; formal supply-chain assessments pending. | 2026-09-23 (recorded, not independently verified) |
| NIS2-4 | Business continuity and crisis management Continuity plans including backup and crisis management. |
Partial | Migration-based reproducibility + managed backups; tested continuity plan pending. | 2026-09-23 (recorded, not independently verified) |
End of matrix · 2026-09-23 · XBANQ GmbH