# Trust Center — what we can evidence, and what we cannot https://www.explicio.com/en/trust/ Last updated: 2026-11-02 > Explicio runs an integrated management system built to ISO/IEC 27001 and ISO/IEC 42001, a data protection impact assessment, a risk and incident register, and a signed software bill of materials per release. Nothing is certified yet, and this page says so wherever it matters. TRUST CENTER # Evidence, not seals. We hold neither ISO 27001 nor SOC 2. What we do have is listed here — with the document behind it. A seal is a third party's statement about us. As long as we hold none, the most honest answer is the list of what actually exists: registers, procedures, measurements, and where to read them. Explicio runs an integrated management system built to ISO/IEC 27001 and ISO/IEC 42001, a data protection impact assessment, a risk and incident register, and a signed software bill of materials per release. Nothing is certified yet, and this page says so wherever it matters. - **Management system**: ISO/IEC 27001 + 42001, built - **Certification**: none - **Controller**: TACP Operations GmbH & Co. KG - **Registered office**: Detmold, Germany LIMITS FIRST We do not claim zero-knowledge (our operations team can reach content during an incident — our privacy notice says so), no confidential computing, and no critical-infrastructure suitability. Where a claim depends on a review that has not happened, it is not on this page. WHAT EXISTS ## Six registers we keep — and where they lead. All are working documents, not brochures: every entry is written in the same step as the change it describes. ISMS Management system Policies, risk method and register, statements of applicability for 93 controls (ISO/IEC 27001:2022) and 38 controls (ISO/IEC 42001:2023), suppliers, incident management, business continuity, training, internal audits, management review. PRIVACY Impact assessment A DPIA under Art. 35 GDPR with a risk register per processing activity, measures, and residual risk. Outcome: required, residual risk medium, not an Art. 36 case. [AIAI system register→Every AI system with its intended purpose, Art. 5 and Annex III review, models, data classes, human oversight and limits. Every new feature answers whether it changes the classification.](https://www.explicio.com/en/offenlegung/) SECURITY Security register Every deliberate security trade-off with date, scope, test and named residual risk — in the same commit as the implementation. Currently 56 entries. SUPPLY CHAIN Software bill of materials A CycloneDX bill of materials per shipped image, generated from the registry and signed as an aggregate; the check against known vulnerabilities runs on every build. [CONTRACTSub-processors→Whoever processes on our behalf is named, with purpose and location, in a public document — and whoever does not is not listed there either.](https://www.explicio.com/en/unterauftragsverarbeiter/) INTERNAL AUDITS ## Five rounds, and what they found. An external penetration test is scheduled for Q2 2027. Until then we audit ourselves — with a method designed not to go easy on us. - METHOD 01 Several reviewers, then a counter-review Each round runs in parallel tracks; afterwards every finding is re-checked by someone who did not find it. In round 5 that lowered several severities, raised one, and corrected two diagnoses. - RESULT 02 Findings are counted, not talked away Round 4: 67 findings, 10 of them high. Round 5: 62 findings, 4 of them high — all four closed. What stays open stays open with a reason, and the reason is in the report. - PATTERN 03 The most uncomfortable class first Round 5 introduced a class of its own: promises without a mechanism — a deadline without a clock, a role without a person, an evidence link without the evidence. Twelve of 62 findings fell into it. MEASUREMENT REPORTS ## Numbers with a method, not without. Every number we quote has a report with setup, metrics, raw data and a counter-check. Where we have not measured, we say so. LOAD A thousand boxes on the real protocol The fleet load test ran a thousand simulated boxes against the platform using the real protocol. The database was not the limit — memory per open connection was, and it sits at three times the target figure. MEDIA 272 pages in one go A maximum test ingested a 272-page scan without a text layer in full and then answered eighteen questions from it — counting hits and refusals honestly. [AVAILABILITYMeasured, not promised→Two independent probe locations measure every minute; a missing sample counts as downtime. The figures and their measurement basis are on the status page.](https://explicio.cloud/status) MODELS Bake-offs instead of gut feeling Which model runs is decided by a comparison with measured figures and a regression set that runs again on every switch. We do not train or fine-tune the large language model; we select it. Our small decision models we develop and train ourselves, on data we generate. [DETERMINISMReproducible means: the decision→Our inference hardware is not bit-stable at temperature=0. We measured where it flips and why; decisions have since been taken in a short call of their own. With whitepaper and raw data.](https://www.explicio.com/en/trust-determinism/) [DECISION MODELSExplicio pair4, built in-house→Our own model for the three decisions before every search, measured against large language models on the same test sets. With benchmark, limits and whitepaper.](https://www.explicio.com/en/trust-decision-models/) QUESTIONS FROM A REVIEW ## Reviewing us and need a document? Tell us which one. What can be public is here; the rest you get under confidentiality. [Request a document](https://www.explicio.com/en/contact/) - **Disclosure**: [security.txt](https://www.explicio.com/.well-known/security.txt) - **Sub-processors**: [Document](https://www.explicio.com/en/unterauftragsverarbeiter/) - **Privacy**: [Notice](https://www.explicio.com/en/datenschutz/) - **Operations**: [Status page](https://explicio.cloud/status)