Frameworks and status

Buyers need to know which standard a program is written against, and whether an auditor has tested it. Both answers are short.

Aligned to ISO/IEC 27001 and SOC 2. Independent audit planned.

ISO/IEC 27001

The information security policies follow the structure of ISO/IEC 27001:2022, including Annex A. Top management approved that policy set on 7 October 2026. Approval means the documents are company policy. It does not mean an auditor has tested them.

An independent audit has not been commissioned.

SOC 2

Controls are mapped to the AICPA Trust Services Criteria. Security is the category in view. Availability, Confidentiality, and Privacy are mapped so a future scope can be discussed. They are not selected for a report.

No SOC 2 report has been issued. There is no observation window to describe. An independent audit is planned. It is not scheduled on this page.

Privacy law

The public privacy notice describes how Vibgrate handles personal data. A data processing agreement is available on request. We do not describe the service as meeting a statute by name on this page.

What a status is not

There is no badge to embed, no percentage, and no PDF of an auditor's opinion. If a questionnaire asks for a report, the honest reply is the sentence at the top of this page, plus the policy summaries and the subprocessor list.