ISO/IEC 27001:2022
Self-attestedOur own assessment against the standard. Not certified, and no certification body has audited it.
oddly · estate cloudflare+github · updated 2026-10-16
Serving on oddlytrust.com while trust.myoddly.com finishes provisioning (verification: pending; certificate: not requested).
Posture is scored from the evidence on file, which is not yet refreshed automatically. Controls with no evidence score zero and say so; the receipts below show how old each piece of evidence is.
Our own assessment against the standard. Not certified, and no certification body has audited it.
Controls mapped to the AICPA 2017 Trust Services Criteria. This is our own assessment. No CPA firm has examined them, and we hold no SOC 2 report.
| Framework | Posture | Coverage | |
|---|---|---|---|
| ISO/IEC 27001:2022 Annex A | 12% | 15/93 evidenced (16%) | |
| SOC 2 Trust Services Criteria (2017 with 2022 points of focus) | 14% | 12/61 evidenced (20%) |
Every control carries the date its evidence was last read, not a badge a document asserts. Evidence older than its window reads Stale.
0 verified · 27 stale · 0 diverged · 0 unknown · 127 not covered
| Control | State | Freshness | Source |
|---|---|---|---|
| iso27001-2022 A.5.15 | Stale | evidence 78 days old | config_read |
| iso27001-2022 A.5.18 | Stale | evidence 78 days old | config_read |
| iso27001-2022 A.5.24 | Stale | evidence 78 days old | config_read |
| iso27001-2022 A.5.26 | Stale | evidence 78 days old | config_read |
| iso27001-2022 A.8.13 | Stale | evidence 78 days old | config_read |
| iso27001-2022 A.8.15 | Stale | evidence 78 days old | log_row |
| iso27001-2022 A.8.16 | Stale | evidence 78 days old | log_row |
| iso27001-2022 A.8.2 | Stale | evidence 78 days old | config_read |
| iso27001-2022 A.8.28 | Stale | evidence 78 days old | ci_run |
| iso27001-2022 A.8.29 | Stale | evidence 78 days old | ci_run |
| iso27001-2022 A.8.3 | Stale | evidence 78 days old | config_read |
| iso27001-2022 A.8.31 | Stale | evidence 78 days old | config_read |
| iso27001-2022 A.8.32 | Stale | evidence 78 days old | config_read |
| iso27001-2022 A.8.6 | Stale | evidence 78 days old | log_row |
| iso27001-2022 A.8.8 | Stale | evidence 78 days old | ci_run |
| soc2-tsc A1.1 | Stale | evidence 78 days old | log_row |
| soc2-tsc A1.2 | Stale | evidence 78 days old | config_read |
| soc2-tsc CC4.1 | Stale | evidence 78 days old | log_row |
| soc2-tsc CC4.2 | Stale | evidence 78 days old | log_row |
| soc2-tsc CC5.2 | Stale | evidence 78 days old | config_read |
| soc2-tsc CC6.1 | Stale | evidence 78 days old | config_read |
| soc2-tsc CC6.3 | Stale | evidence 78 days old | config_read |
| soc2-tsc CC7.1 | Stale | evidence 78 days old | ci_run |
| soc2-tsc CC7.2 | Stale | evidence 78 days old | log_row |
| soc2-tsc CC7.4 | Stale | evidence 78 days old | config_read |
| soc2-tsc CC7.5 | Stale | evidence 78 days old | config_read |
| soc2-tsc CC8.1 | Stale | evidence 78 days old | config_read |
127 control(s) have no evidence source connected. They are published as gaps, not hidden.
Every sub-processor across all products. Sub-processors are scoped per product: a customer viewing this page through their own engagement sees only the ones that process their data.
| Sub-processor | Products | Jurisdiction | Data and DPA | Clauses and provenance |
|---|---|---|---|---|
| Edge application platform Application hosting, edge compute, and the primary datastore. |
All products | Global (edge network) Global edge network |
operational-metadata, account-records DPA signed |
iso27001-2022 A.5.19 iso27001-2022 A.5.20 iso27001-2022 A.5.21 soc2-tsc CC9.2 iso42001-2023 A.10.3 Derived from observed egress (platform binding inventory), last seen 2026-08-12. |
| Source control and CI provider Version control, code review, and continuous integration. |
All products | United States United States |
source-code, build-metadata DPA signed |
iso27001-2022 A.5.19 iso27001-2022 A.5.20 iso27001-2022 A.5.21 soc2-tsc CC9.2 iso42001-2023 A.10.3 Declared in the sub-processor register (sub-processor register). |
| Date | Change | Detail |
|---|---|---|
| 2026-06-01 | Added | Edge application platform was added as a sub-processor for every product, processing operational-metadata, account-records. GDPR Art 28(2): the controller is informed of the intended change and may object. Objection window closes 2026-07-01. |
| 2026-06-01 | Added | Source control and CI provider was added as a sub-processor for every product, processing source-code, build-metadata. GDPR Art 28(2): the controller is informed of the intended change and may object. Objection window closes 2026-07-01. |
The detailed control ledger and evidence pack are available under NDA. Request access with a verified email; access is granted by approval and expires automatically.
Granted access expires 14 days after it is issued.
Request detailed accessWhich agents may decide what, on what evidence, granted by whom, and what revokes it. Generated from the register the running code consults.
View the authority tablePosture is scored by one fixed rule from the evidence on file. No estimate, no default-green.