Compliance status
Frameworks we meet today, and the attestations under way. Each state reflects what we can evidence now.
Last updated 6 frameworksJSON
The Quantum Club does not currently hold a SOC 2 attestation or ISO 27001 certification.
The register
6 frameworks, as they stand
Each row links to the framework’s page: its scope, what is in place, and what is not yet.
| Framework | State | Scope | Last updated |
|---|---|---|---|
| GDPR | Live | Processing of personal data across the Club OS platform and its supporting EU infrastructure, for all customer and candidate data. | |
| EU data residency | Live | Primary storage and processing of core customer data in the European Union (AWS eu-west-1, via Supabase). | |
| EU AI Act | Aligned | Transparency and human-oversight duties for the AI-assisted hiring features of Club AI, treated as a high-risk use under the Act. | |
| SOC 2 (Type II) | Aligned | Security, Availability and Confidentiality criteria, covering the Club OS platform and its supporting infrastructure.No independent attestation has been obtained yet. | |
| ISO/IEC 27001 | Aligned | Information-security management for the Club OS platform, mapped to the ISO/IEC 27001:2022 Annex A controls.Formal certification not yet obtained. | |
| ISO/IEC 42001 (AI) | Roadmap | Governance of the AI systems behind Club AI — risk management, transparency and human oversight.Certification not yet pursued; on the roadmap. |
The scale
What each state means
Four states, and only these. A framework is shown at the state we can evidence today.
- Live
- Implemented and in effect now.
- 2 · GDPR, EU data residency
- Aligned
- Controls and posture meet the framework; no third-party attestation claimed.
- 3 · EU AI Act, SOC 2 (Type II), ISO/IEC 27001
- In progress
- An audit or engagement is actively under way.
- None today
- Roadmap
- Committed, not yet started.
- 1 · ISO/IEC 42001 (AI)
What moves a state
How a state changes
A framework moves to In progress the day an audit engagement starts. When the work completes, its page publishes the report and the auditor.
The controls behind each framework are listed on its page, with the other frameworks each control supports. The security questionnaire answers in its own terms: Yes, Partial, Planned or No.