Security, privacy, and the documents behind them.

SOC 2 Type I

Independent point-in-time audit of our security controls. Report available under NDA at launch.

SOC 2 Type II

Independent audit of our security, availability, confidentiality, and processing-integrity controls operating over time.

ISO/IEC 27001

International standard for information security management.

ISO/IEC 42001

International standard for responsible AI management systems.

GDPR

GDPR-ready

EU data protection — DPA, subprocessor list, and data-subject-rights process in place. See our Privacy Policy and DPA.

Penetration Testing

Independent third-party security testing. Executive summary available under NDA.

NIST AI RMF

Aligned

Aligned to the U.S. framework for trustworthy AI risk management.

NIST CSF 2.0

Aligned

Aligned to the U.S. Cybersecurity Framework as our internal control backbone.

PCI DSS (SAQ A)

Payment card data is tokenized and handled entirely by Stripe; SHAKE maintains PCI DSS SAQ A scope.

SOC 1 (SSAE 18)

Assurance over controls relevant to customer financial reporting, covering the Value Ledger as our billing system of record.

NIST SP 800-171 + SPRS

Self-assessment against all 110 controls for the SHAKE Gov boundary, with SSP, POA&M, and a posted SPRS score under executive affirmation.

FedRAMP 20x (Moderate)

Automation-first authorization of the isolated SHAKE Gov boundary on FedRAMP-authorized GovCloud, for federal and CUI workloads.

CMMC Level 2

Third-party (C3PAO) certification for defense work, built on our NIST 800-171 evidence base.

ITAR / EAR

U.S. export-control compliance program, including US-persons access controls, for the SHAKE Gov boundary.