Created 13 October 2026 Last updated 2 November 2026

Compliance Status

HyperMemory operates an integrated information security programme aligned to ISO/IEC 27001:2022 and all five SOC 2 Trust Services Categories. The public register summarizes the approved governance and control baseline. Detailed operating records, evidence administration, review schedules, personnel assignments, remediation activities, and internal risk decisions are maintained in controlled compliance records.

Green identifies a policy, procedure, control design, operating safeguard, or governance decision that is approved, ready, or implemented as stated.

Programme baseline

Measure	Current state
Programme objective	Integrated ISO 27001 and all-five-category SOC 2 programme approved
External certification and attestation	Planned as a future assurance activity
ISMS scope	Approved for HyperMemory services, supporting infrastructure, people, processes, and information assets
Governance baseline	Controlled policies, procedures, registers, responsibilities, and review requirements are approved and maintained
Annex A control framework	All 93 controls assessed and mapped, with applicable requirements governed through approved controls
SOC 2 categories	Security, Availability, Processing Integrity, Confidentiality, and Privacy approved and mapped
Operating-effectiveness model	Six-month internal observation and evidence model approved

Core control readiness

Control area	Public status
Governance and accountability	Security ownership, approval authority, responsibilities, review rules, and controlled documentation are established
Risk management	Risk assessment, treatment, acceptance, exception, and continual-improvement processes are approved
Identity and access	Named accounts, MFA, approved access grants, timely revocation, and privileged-access reviews are implemented
Asset and information management	Asset ownership, inventories, classification, handling, retention, and secure-disposal requirements are established
Cryptography and secrets	Encryption in transit and at rest, protected secret storage, key-based administration, and credential-management controls are implemented
Network and infrastructure security	Default-deny networking, controlled administrative access, firewall governance, backups, and infrastructure monitoring are implemented
Secure development and change management	Source control, review, testing, dependency management, deployment control, rollback, and production-change safeguards are implemented
Vulnerability management	Code, dependency, infrastructure, endpoint, and production-testing procedures are defined and operated under approved rules
Logging and monitoring	Security-relevant activity, administrative access, system health, and operational events are logged and reviewed
Availability and recovery	Availability objectives, daily backups, component restoration, full-system recovery, and continuity procedures are established
Incident response	Severity classification, response targets, escalation, communications, investigation, recovery, and post-incident review procedures are approved
Supplier governance	Supplier classification, standard terms, DPAs, transfer safeguards, subprocessor disclosures, assurance review, and exit controls are documented
Privacy and data protection	Controller and processor roles, lawful-basis governance, privacy rights, deletion, retention, privacy by design, and transfer controls are established
Personnel security	Confidentiality, policy acknowledgement, awareness, access lifecycle, remote-work, and security-event reporting controls are established
Physical and endpoint security	Controlled workspaces, protected equipment, encryption, automatic locking, malware protection, updates, remote wipe, and secure repair controls are implemented
Processing integrity	Authorization, validation, idempotency, error handling, transaction control, recovery, and integrity safeguards are implemented

ISO/IEC 27001 status

The ISO baseline covers ISO/IEC 27001:2022 clauses 4–10, the climate-action amendment, and the organizational, people, physical, and technological Annex A control themes.

Requirement area	Brief description	Current state
Clause 4 — Context	Organizational context, interested parties, obligations, and ISMS scope	Context, interested parties, obligations, and scope are documented and approved
Clause 5 — Leadership	Management commitment, policy, roles, and authorities	Security policy, leadership accountability, roles, and approval authority are established
Clause 6 — Planning	Risk management, Statement of Applicability, objectives, and planned changes	Risk method, treatment plan, Statement of Applicability, objectives, and change controls are approved
Clause 7 — Support	Resources, competence, awareness, communication, and documented information	Resource, competence, awareness, communication, and controlled-document requirements are established
Clause 8 — Operation	Risk treatment and controlled operation of security processes	Operating procedures, risk treatment, supplier controls, and technical safeguards are implemented
Clause 9 — Performance evaluation	Monitoring, measurement, internal review, and management review	Metrics, monitoring, review, and proportionate internal-assurance procedures are approved
Clause 10 — Improvement	Nonconformity, corrective action, and continual improvement	Corrective-action, exception, root-cause, and continual-improvement processes are established
Annex A.5 — Organizational controls	Policies, ownership, assets, suppliers, incidents, continuity, privacy, and legal obligations	Applicable organizational controls are mapped to approved policies, procedures, and safeguards
Annex A.6 — People controls	Screening, terms, awareness, confidentiality, remote work, and event reporting	Applicable people controls are mapped to approved lifecycle and security requirements
Annex A.7 — Physical controls	Premises, equipment, media, environmental protection, utilities, and disposal	Applicable physical controls are mapped to implemented workspace, equipment, media, and disposal safeguards
Annex A.8 — Technological controls	Access, authentication, vulnerability management, logging, resilience, development, and change	Applicable technological controls are mapped to implemented platform and operational safeguards

SOC 2 status

Trust Services area	Brief description	Current state
Security	Protection against unauthorized access, use, or disclosure	Security governance and organizational, access, infrastructure, development, monitoring, and response controls are approved and implemented
Availability	Availability commitments, resilience, backup, recovery, and incident handling	Availability objectives, monitoring, backups, recovery, continuity, and incident procedures are established
Processing integrity	Complete, valid, accurate, timely, and authorized processing	Validation, authorization, transaction, idempotency, recovery, error-handling, and integrity controls are implemented
Confidentiality	Protection of confidential information through its lifecycle	Classification, access, encryption, sharing, retention, and secure-disposal requirements are established
Privacy	Collection, use, retention, disclosure, and disposal of personal information	Privacy governance, rights handling, lifecycle controls, processor oversight, and transfer safeguards are established

Review

The public register is reviewed after material changes and as part of the governance review cycle. Controlled evidence and internal operational detail remain in the private compliance repository.