VianordisTrust centre.
Current claim status, scope, evidence position, and limitations. An absent certificate, test record, or schedule is not implied by design language.
| Claim | Status | Scope | Evidence | Limitations |
|---|---|---|---|---|
| Company and contracting | Current | GoSec Cloud OÜ | Public Imprint and contracting copy | Signed service documents control |
| Software licensor | Current | GoSec Cloud OÜ | Source & Licensing page | Foundation cutover has not occurred |
| ISO/IEC 27001 | Controls mapping | Organisation and selected managed-service controls | No public certificate | No certification or completed audit claimed |
| Regions | Validation and production scope separated | Current website: OVHcloud VPS in France. Managed-service validation locations are disclosed per invitation. Future production provider and regions remain under selection. | Website deployment record; signed service schedule required for managed services | No universal production region, replication, RPO, RTO, or failover claim |
| Subprocessors | Contract-specific | Selected managed service | Processor schedule supplied with contract | No universal EU-only chain claimed |
| Availability and recovery | Validation | Only the service and version named in an order | Test evidence supplied where available | No production SLA for Alpha or Controlled Beta |
| Encryption and key custody | Service-specific | BYOK, CYOK, or HYOK by tenant and data domain | Architecture scope supplied during review | HYOK metadata, proxy, backup, and failure boundaries must be documented |
| DPA and processing terms | Contract document | Managed-service processing | Provided with the managed-service contract | Privacy Notice is not a DPA |
| Export, deletion, and exit | Application-specific validation | Functions expressly listed in an order | Procedure and evidence supplied where validated | Not yet uniform across all applications |
Operational evidence still pending publication.
Certificate documents, a versioned subprocessor schedule, service-specific region and recovery results, responsibility matrices, incident history, support coverage, encryption implementation notes, and detailed export and exit procedures will be added only when their scope and evidence are ready.
The applicable DPA is provided with the managed-service contract. The public Privacy Notice describes website processing and is not a substitute for that agreement.
Technical controls support compliance work; they do not establish legal conformity. Outcomes depend on role, configuration, data, intended use, customer process, and applicable law.