Compliance

This is the distinction that almost everybody collapses, and the whole page depends on it, so it is worth stating flatly.

• Security is our own account of what we do. Self-reported. It lives on our Security page, which is also the source of the security measures in our Data Processing Agreement.
• Compliance is somebody else’s verification that we do it. Externally attested. That is this page.

“We encrypt customer data at rest” is a statement for the Security page. “An accredited auditor tested our encryption controls across a twelve-month window and issued an unqualified opinion” is a statement for this one. The first is a description. The second is evidence produced by someone with no commercial interest in the answer.

So this page answers one question, in as few words as it can: who checked, and can we see the report?

The table below is the complete list of the standards a reviewer is likely to ask us about, grouped the way procurement teams usually group them. Nothing in it is held. It is a long table for a short answer, and it is here because knowing which of these apply to us, which do not, and why is more useful than a single “no”.

What “not held” does and does not mean

It does not mean the controls do not exist. Tenant isolation, tenant-scoped authentication, role-based access control, per-user multi-factor authentication and audit logging are all built and running, and Our security architecture links to where they are described in detail.

It means no independent party has tested them and issued a report. Those are two different claims and we are not going to blur them, because blurring them is precisely what a certification exists to prevent.

A certificate is a way of answering a reviewer’s questions without their having to ask. Where we cannot hand over the certificate, we can still answer the questions. This is everything available now, and what is not yet ready, so you can see both at once.

Several frameworks are worth pursuing, and one of them is worth pursuing first. Which one is a commercial question rather than a technical one, and the honest deciding factor is where the revenue is, not which sounds more impressive.

• As a UK company, our first step is Cyber Essentials, then Cyber Essentials Plus. They are cheap and fast, and they close the multi-factor authentication and patching gaps our Security page states, which every later framework would also demand.
• For French buyers, and for larger enterprise buyers generally, the usual answer is ISO 27001, which is the third stage.
• The Software Security Code of Practice self-assessment costs little, so it runs alongside Cyber Essentials rather than after it.
• SecNumCloud and HDS are not on the roadmap: each would mean moving to a qualified or certified host, and they matter mainly for public-sector buyers and for health data, which SorviAI is not offered for.
• ISO 27001 and SOC 2 are each six to twelve month projects with real external cost and meaningful internal time. Neither is a document exercise that compresses into a sprint, and we are not going to pretend otherwise on a roadmap.

Our position: Cyber Essentials first, then Cyber Essentials Plus, then ISO 27001, with the Software Security Code of Practice self-assessment alongside Cyber Essentials; SOC 2 Type II only if our buyers require it. Decided on 28 September 2026.

The stages

No stage has a target date yet. Each date will be added here when it is set, and not before: a roadmap with invented dates is worse than one that admits it has none.

Written for the reviewer who has been handed a policy naming a framework and now has to work out what it would actually tell them about us. This section holds no claims about SorviAI at all; every status is in Certification status.

Cyber Essentials and Cyber Essentials Plus

A UK government-backed scheme covering a baseline of five technical control areas. The base level is a verified self-assessment; “Plus” adds hands-on technical testing by an assessor. Both are far cheaper and faster than ISO 27001, so it can be the right first step for reasons that have nothing to do with which framework is more rigorous. Certificates last twelve months.

Software Security Code of Practice

Published in May 2025 by the Department for Science, Innovation and Technology and the NCSC. It sets out, in 14 principles, what software vendors should do across secure design and development, build environment security, secure deployment and maintenance, and communication with customers. It is voluntary, and conformance is declared by the vendor itself. Treat a declaration as a statement of intent backed by whatever evidence the vendor offers, not as an audit.

ISO/IEC 27001

Certifies that an organisation operates an information security management system: documented policies, a risk assessment method, a defined set of controls, internal audits and management review. It certifies that security is run as a system. It does not certify that any individual control is strong.

Issued by an accredited certification body after a two-stage audit, then maintained through annual surveillance audits with full recertification every three years. Preparation typically runs six to twelve months and is more a documentation and process undertaking than an engineering one. Look for a certificate from a body accredited by a national accreditation body, in France the COFRAC.

Its extensions: ISO 27017 adds cloud-specific controls, ISO 27018 adds protection of personal data in a public cloud, and ISO 27701 adds a privacy management system. All three ride on a live 27001 certificate. A vendor citing 27018 without 27001 is describing something that cannot exist.

SOC 2

Not a certification but an attestation: a report produced by a CPA firm on controls measured against five trust services criteria. Security is mandatory; availability, processing integrity, confidentiality and privacy are optional scope. Two reports naming the same framework can therefore cover very different ground, which is why scope is worth asking about.

Type II is substantially harder, substantially more expensive, and the one enterprise buyers mean when they say “SOC 2”. A vendor writing “SOC 2” without the type reads as evasion, and a reviewer will ask.

A SOC 2 report is not a public document. What a vendor publishes is that they hold one; the report itself is released under NDA. A bridge letter covers the gap between the end of the last window and today.

SOC 1, and why it appears here at all

SOC 1 reports on controls relevant to a customer’s own financial reporting, rather than on security generally. It is unusual on a SaaS compliance page and it is on ours because SorviAI holds general ledgers, journals and invoices. If a customer’s external auditor eventually places reliance on our system, SOC 1 is the report they will ask for. It is not in our current scope, and we would rather say that in advance than be surprised by the question.

CSA STAR

A registry run by the Cloud Security Alliance, at three levels: Level 1 is a published self-assessment, Level 2 is a third-party audit built on ISO 27001 or SOC 2, and Level 3 is continuous monitoring. Level 1 entries are free and self-published, so appearing in the registry is not itself a certification, and any vendor presenting it as one is overstating it.

PCI DSS

Applies only to organisations that store, process or transmit cardholder data. It is a scope question before it is a compliance question, and Payments and PCI DSS sets out our scope.

SecNumCloud and HDS

SecNumCloud is a qualification ANSSI grants to a cloud service after evaluation by a licensed assessor, with requirements on security, on where data is stored and on protection from non-EU law. HDS is the certification French law requires of anyone hosting personal health data on behalf of others. Both attach to the hosting as much as to the software, so a service can only reach them by running on qualified or certified infrastructure.

Certified cash register software

A business liable to TVA (French sales tax) that records payments from customers who are not businesses in cash register software must use software meeting conditions of inalterability, security, conservation and archiving of the data, shown by a certificate from an accredited body (NF525 is the best known) or by the means the tax law allows (Code général des impôts, article 286, I-3° bis). The duty is the business’s, and it falls on the till it actually uses.

These are laws we are subject to, not audits we have passed. No certificate exists for most of them, and no auditor issues one, so this section is a statement of our position and of what is still missing, with a link to the document carrying the substance.

SorviAI does not currently use an AI provider; if one is added it will be listed as a sub-processor with its transfer basis.

Why none of these rows says “compliant”

“GDPR compliant” as a standalone claim carries almost no information. Nobody certifies it, and a reviewer asking about the GDPR is not looking for the adjective. They need two concrete things: a data processing agreement, and a lawful mechanism for each transfer. The first is published; the second is set out, transfer by transfer, in the agreement, including the gap that remains for HR data reached from the United States by our hosting provider.

So each row points at the document rather than asserting a state. If you find yourself unable to get from a row to the thing it names, that is a fault worth reporting to us, and our contact details are below.

French tax, commercial and employment law reach into how a product behaves, not only into what its policies say. SorviAI Finance and POS are offered in France, and this section sets out plainly what they do and do not do for the records French law requires, so that you and your expert-comptable can decide how to use them before you rely on them. It is not tax or legal advice.

Tax returns and filing

SorviAI Finance keeps your books and produces reports from them. It files nothing with the French tax administration or any company register: no TVA returns, no liasse fiscale, no annual accounts and no statistical declarations. You will need separate software or an expert-comptable for those, and filing on time remains your responsibility.

The FEC (fichier des écritures comptables)

A business that keeps its accounts on computer must be able to hand the tax administration, during an audit, a file of all its accounting entries in a set format: the FEC (Livre des procédures fiscales, article L47 A). SorviAI Finance has no FEC export, and it has no read-only role for an auditor. Produce your FEC from the accounting software or the expert-comptable that keeps your books of record.

The e-invoicing reform

France is moving invoices between businesses established in France onto structured electronic invoices, exchanged through a plateforme agréée, a platform approved by the tax administration. Since 1 September 2026 every business must be able to receive electronic invoices, and large and intermediate-sized businesses must issue them and transmit e-reporting data; small and medium-sized businesses and micro-enterprises must issue them from 1 September 2027. A PDF is not an electronic invoice under the reform.

SorviAI Finance produces PDF invoices only. It is not a plateforme agréée and is not connected to one, has no structured e-invoice output and cannot receive structured e-invoices, so it cannot meet the duty to receive that has applied since 1 September 2026 or the duty to issue. Use a plateforme agréée for both, and treat the invoices there as your record.

Record retention is separate from our backups

French law requires you to keep accounting documents and supporting documents for ten years (Code de commerce, article L123-22), and gives the tax administration a right to inspect tax records for six years (Livre des procédures fiscales, article L102 B). Invoices kept outside France must meet the conditions of article L102 C of the same code, which also requires you to declare where they are kept. SorviAI holds your data in London, in the United Kingdom; ask your expert-comptable whether that meets those conditions before you rely on SorviAI to hold any invoice. That duty is yours, and it continues after you stop using SorviAI. Our database backups are kept for seven days to recover the service after a failure; they are not an archive and do not meet any retention duty. Exports today run per screen or per report, and list exports are capped at 20,000 rows; Nest downloads one file at a time; TeamEmail, Storefront, POS and Escalate have no export; there is no whole-workspace export, so our team does a full export for you on request, as our Terms of Service set out. Keep your own copies for the statutory period.

One more point for your records: an invoice that has been sent, or partly paid, can still be edited in place in SorviAI Finance, lines and totals included, and a posted accounting entry is not locked by a period close. French practice is that an issued invoice is corrected by a credit note (avoir) and a validated entry by a new entry, never by editing. If you need the invoice as issued, keep the PDF you sent or export it at the time.

Point of sale

SorviAI POS is not certified cash register software under French law (Code général des impôts, article 286, I-3° bis), and holds no NF525 or other certificate. A business liable to TVA that records payments from customers who are not businesses must use certified cash register software. SorviAI POS can show a Daily Summary (Z-report) computed from the day’s sales, but it does not store or seal that report, keeps no daily, monthly or yearly closures with running totals, writes no audit records today and produces no tamper-evident log. Do not use SorviAI POS as your till for those payments; keep your till records in certified software.

Worklink and employment records

Worklink records employee attendance: check-in and check-out times, the IP address each came from, breaks, hours, overtime, a reason for arriving late, and leave. Working from home is recorded as an approved request rather than on the daily record. Check-in is by kiosk code or by signing in. Worklink also marks employees absent automatically each day when no attendance is recorded; this is an automated step that people review, not a decision made solely by software. Worklink uses no biometrics: no fingerprint, face or other biometric recognition, only an optional profile picture.

• Working time. French employment law requires employers to record working time in some situations and to keep those records available to the labour inspectorate. Worklink’s attendance records can support that, and the attendance records export (CSV or Excel) carries each day’s times, breaks, hours and overtime; no automatic deletion applies to them.
• Right to work and identity documents. Worklink has no right-to-work field or document type. Copies can be uploaded as general employee documents, but nothing tracks them or applies a retention rule, so keep the official record elsewhere.
• National identification and social security numbers. French law limits the use of the social security number (NIR) to specific purposes such as payroll and social declarations; do not use it as an identifier. Worklink has no dedicated field for them, so they go into the free-text national ID, tax ID or social security ID fields. Those fields are stored in plaintext and returned in full by the API to anyone with access to employee records; they are not restricted to payroll roles. Detail screens show only the last four characters, but the edit form shows the full value. Grant that access with that in mind.
• Sickness absence. Every workspace that uses Worklink comes with a “Sick Leave” type, and each leave request needs a free-text reason, so illness details can end up in that field. Leave requests can also carry supporting documents such as a doctor’s note. Both are health data, a special category under the GDPR; record the fact and duration of an absence, not a diagnosis, and do not use Worklink for occupational health records.
• Employees and the CSE. Employees must be told about a system that collects information about them before it is used (Code du travail, article L1222-4). In a company with 50 or more employees, the comité social et économique (CSE) must be informed and consulted before a means of monitoring employees’ activity is introduced (article L2312-38). Both duties are the employer’s. Worklink records the IP address of every check-in and check-out, and our error reporting records some sessions on screen (see the sub-processor table): include both when you inform them.
• Who decides. The employer is the controller for Worklink data and decides what is recorded and for how long; SorviAI processes it on the employer’s instructions.

Storefronts and portals

Storefronts built on SorviAI show the business’s own catalogue and take enquiries, which go only to that business. There is no checkout, no payment and no public user content. Three storefront pages show a file field that sends nothing, although the page tells the visitor the upload worked. Customer and Vendor Portals show each portal user the documents on their own customer or supplier record, including files uploaded by other logins of the same customer and by the business’s staff; portal users can upload documents, and the portals have no ticket view. A storefront run from France is the business’s own website, so it needs its own mentions légales (loi n° 2004-575 du 21 juin 2004, article 1-1) and privacy notice; the storefront themes have no dedicated place for them today.

Accessibility

Our storefront templates and admin application have not been audited against WCAG 2.2 AA or EN 301 549, and no audit is scheduled yet. A customer whose storefront must meet an accessibility standard, for example as a public-sector body, carries that duty for its storefront. We make reasonable adjustments for disabled users of our service on request.

Card numbers never reach SorviAI’s servers. That single fact settles most of what a reviewer needs to know here, but it is worth setting out how, because the difference between “we are compliant” and “we are out of scope” matters and is frequently blurred.

Your SorviAI subscription is paid through Stripe, which is certified as a PCI DSS Level 1 service provider. You enter card details on pages and fields hosted by Stripe, not by us. What SorviAI stores is Stripe’s reference for your customer account and your subscription. When we show your card on the billing page, the brand, last four digits and expiry date are fetched from Stripe for display and are not stored by us. The full card number never reaches our servers, our logs or our backups.

The practical consequence is that our own PCI scope is minimal, in the territory a self-assessment questionnaire covers rather than a full assessment. We state that as a scope position and nothing more.

Payments taken by our customers

Storefronts built on SorviAI take enquiries and have no checkout, so no card data passes through them at all. Separately, a customer can connect its own Stripe account so that its customers can pay its invoices online. That payment happens on Stripe’s own pages, under the customer’s agreement with Stripe, and the money goes to the customer’s own connected account; SorviAI creates that connected account and the charge using its own Stripe platform key, and sends the payer’s email address and the invoice number to Stripe. Card numbers do not reach SorviAI there either, and any PCI scope that arrangement carries is the customer’s, not ours. It is worth asking the question before connecting it.

The third parties with access to customer personal data are listed here, with what they do, where they are and what safeguard is in place, followed by the services your browser loads from third parties while you use SorviAI. This list is the maintained version.

We separate our own sub-processors from integrations you choose to switch on, because the second group works on your instructions under your own agreement with that provider. We announce any change on this page and by email to workspace account owners at least 30 days before a new sub-processor begins handling customer data. Nothing in the product sends that notice automatically, and there is no separate subscription to sign up for. The certifications below are the suppliers’ own, as their sites stated them on 28 September 2026; they are not ours.

SorviAI’s sub-processors

SorviAI does not currently use an AI provider, and no AI provider receives customer data; if one is added it will be listed here with its transfer basis.

Integrations you choose to switch on

These are not our sub-processors. When you connect one, data goes to that provider on your instruction, and your own agreement with that provider governs it.

The application, the database and uploaded files are all in DigitalOcean’s London region, for every workspace wherever the customer is. Data still leaves the United Kingdom in a few ways, each needing a lawful basis of its own, set out below.

Everything we host is in London today, and the Data Processing Agreement records it: we make no international transfer beyond those listed without your authorisation, so moving hosting out of the UK would need your agreement first. We offer no EU data residency; only error reports are processed in the EU.

Why this section carries dates and the others do not

Transfer law has moved repeatedly, through court decisions and successive replacement frameworks, and each move has invalidated arrangements that were correct the day before. The European Commission renewed its adequacy decision for the UK in December 2025, and the EU-US Data Privacy Framework is still being challenged in the courts. It is the one part of this page that can become wrong without anything at SorviAI changing and without anybody here noticing.

So the mechanism rows carry the date they were last confirmed, rather than an implied “as at publication”. If a date above is more than a year old, treat it as a question to ask us rather than an answer.

Full detail is on the Security page. The summary here exists because a reviewer arriving at a compliance page holding no certificates deserves to know, in one screen, what is actually running.

Tenant isolation. Every SorviAI customer is provisioned with a dedicated PostgreSQL schema. Customer records are held in separate database schemas rather than in shared tables partitioned by an identifier column, which removes an entire class of cross-tenant query error rather than relying on every query being written correctly. Requests are resolved to a tenant before reaching application code, and authentication tokens are scoped to a single tenant and validated on every request. A token issued for one workspace cannot read another. User accounts, their two-factor secrets and invitations sit in a shared platform schema, because one person can belong to several workspaces.

Authentication and authorisation. Access tokens expire after 60 minutes and are renewed through a refresh flow while you are active. Multi-factor authentication is available to every staff account at the main sign-in, as a time-based code with recovery codes; administrators cannot yet make it mandatory, the two Django administration sign-ins take a password only, and single sign-on is not supported. Within a workspace, access is governed by role-based permissions scoped to each application, so a role granted in Finance conveys no access to Inventory. Administrative rights are tiered rather than binary: workspace administrators manage the whole workspace, application administrators manage only their own application, and everything else is granted per permission against a central registry.

Audit logging. Audit records are written to the tenant’s own schema, so the audit trail is isolated on the same boundary as the data it describes, and kept for the life of the workspace. It cannot be altered through any interface, but it is not tamper-evident against someone with direct database access.

The gaps are on the Security page too

Administrator-enforced multi-factor authentication, the password-only Django administration sign-ins, single sign-on, internal connections that use TLS without certificate verification, the missing Content Security Policy, audit log coverage and tamper-evidence, backup restore testing, recovery targets, dependency and secret scanning and external penetration testing are all stated there as open, rather than left out.

This is not modesty. A reviewer assumes the worst about an omission and then asks anyway, so the round trip happens either way and the only variable is whether it costs you a week. You will find our gaps faster on our own page than in a questionnaire exchange.

Everything marked public in What we provide instead needs no request at all. For the rest, one address reaches us. Write in English or French; we answer in English.

• Tell us three things. Your organisation, the framework or control set your policy actually names, and your deadline. The third one matters more than people expect: it changes what we prioritise, and we would rather tell you early that we cannot meet it.
• We answer your questionnaire, on your form. We have no policy of responding only to a form of our own, and we do not charge for completing one. If your form asks about a control we do not have, the answer will say so.
• Anything under NDA needs a mutual NDA in place first. Today that applies to nothing, because the documents it would cover do not yet exist. Once a SOC 2 report or a penetration test summary exists, this is the route to it.

Requests reach [email protected], and we respond within 10 working days.

One address for security questionnaires, document requests, and anything on this page you think is wrong. We would rather hear about it than not.

Our full company details are in our Mentions légales.

Data protection and regulatory contacts

The regulators

If you are not satisfied with our answer on a data protection matter, you can go to a supervisory authority at any time. In France that is the Commission nationale de l'informatique et des libertés (CNIL), 3 Place de Fontenoy, 75007 Paris, France, www.cnil.fr, which takes complaints online at cnil.fr/fr/adresser-une-plainte. You can also go to the authority where you live or work elsewhere in the EU; the European Data Protection Board lists them at edpb.europa.eu. For content we host, Arcom is the Digital Services Coordinator in France.

Version 1.1 describes the consent banner, affiliate tracking through Tradedoubler, and Session Replay running only with consent. It replaces version 1.0, effective 1 October 2026. Every later version will be published here with its date, and earlier versions will be kept at this address.

The words on this page that carry a specific meaning, in plain language. Several of them are used loosely in vendor marketing, which is the reason they are here.