Trust and compliance
How we protect your data and your project: the standards we work to, the insurance we hold and the organisations we belong to.
Certifications
We are preparing for independent certification of our management systems. Certificate numbers, scope and validity will be published here once issued.
- ISO/IEC 27001In preparationInformation security management.
- ISO 9001In preparationQuality management.
How we work
These frameworks are part of how we run projects and operate systems. They describe how we work; they are not certifications.
- GDPRPersonal data processed lawfully, with data processing agreements for client work.
- NIS2Risk management, incident handling and supply-chain security in our services.
- DORAICT risk and third-party requirements for clients in financial services.
- EU AI ActTransparency and human oversight in the AI systems we build and host.
- EU Cyber Resilience ActSecure development and vulnerability handling for the software we ship.
- ISO/IEC 27001 practicesOur security controls follow the ISO/IEC 27001 framework.
Insurance
Our work is insured with Exali, a specialist insurer for digital professions.
- Professional indemnityClaims arising from errors or omissions in our professional services.
- General liabilityThird-party bodily injury and property damage.
- Financial lossPure financial loss caused to clients by our work.
- Cyber and data risksFirst-party cover for cyber incidents and data loss.
A certificate of insurance is available on request: legal@theorigamicorporation.com
Memberships
- ISECQBoard member of ISECQ, the independent software certification body.
- IAPPMember of the International Association of Privacy Professionals.
- BESCOMember of the Bulgarian Startup Association.
Security and data
- Hosting is in the EU by default (Germany, France, Bulgaria); US hosting on request.
- How we handle personal data is set out in our privacy policy
- To report a vulnerability, see our security.txt