This page consolidates Certisyn's public posture across security, privacy, residency, key management, audit readiness, and the regimes institutional procurement asks about first. Every claim here is backed by an artefact that ships under it.
Certisyn does not ask institutions to take the verification layer on trust. Three of its core protocols are contributed as Internet-Drafts at the IETF — readable, citable, and on the public record — so the parties that rely on them can read the protocol, not just the vendor's word for it.
A cryptographic verification standard for the ACSC Essential Eight Maturity Model — the deterministic, auditor-grade, independently reconstructable attestation the model was designed to imply but does not deliver.
View on the IETF Datatracker →A cryptographic verification standard for agentic AI governance in regulated industries — sits beneath ISO/IEC 42001 and the NIST AI Risk Management Framework and produces the verifiable artefact they imply but do not deliver.
View on the IETF Datatracker →Internet-Drafts are working documents of the IETF, valid for a maximum of six months and to be cited only as “work in progress.” These are individual submissions; they are not, and do not claim to be, IETF-endorsed or ratified standards. Further protocol contributions are in preparation and will be published here as each enters the public record.
certisyn.com scores AAA+ on the Bastion catalog v2.1 across transport security, email authentication, web headers, cookie security, cross-origin policy, information disclosure, surface exposure, DNS posture, and compliance signals. The catalog is signed; the scan is reproducible.
Run the scan →Five autonomous agents — Sentinel, Warden, Auditor, Chronicler, Envoy — operate against the Certisyn estate continuously. Audit-event immutability, RLS coverage, retention adherence, supply-chain posture, and access integrity are verified without human intervention.
Every policy, control, evidence artefact, control assessment, and gap item is held under SHA-256 digest in a versioned vault designed for audit-evidence projection. Not a theoretical document store — a live system feeding the regimes below.
Master policy plus twenty-two subordinates spanning acceptable use, access control, cryptography, data classification, incident response, business continuity, supplier security, change management, secure SDLC, asset management, physical security, logging, HR security, third-party risk, privacy and DSAR, AI and ML governance, mobile and BYOD, chain of custody, standards authoring, cross-border verification, sanctions, and reserve treasury. Each is version-tracked and bound to the Compliance Vault as living evidence.
AES-256-GCM at rest. TLS 1.2/1.3 in transit. RSA-4096-OAEP for bilateral register channels. X25519 ECDH with HKDF and AES-256-GCM for forward-secret corridors; a hybrid X25519 with ML-KEM-1024 (NIST FIPS 203) sealing path is implemented and conformance-tested for post-quantum forward secrecy. Transport is hash-agile — SHA-512 by default, SHA3-512 (Keccak) for construction-family diversity, SHA-256 for constrained corridors — HKDF keyed to the negotiated family. Attestations carry a hybrid dual-signature envelope binding a classical HMAC-SHA-256 signature to an ML-DSA-65 (NIST FIPS 204, CRYSTALS-Dilithium 3) post-quantum signature, both required to validate. The post-quantum primitives are the audited noble implementation, conformance-tested in CI. Keys generated in hardware-backed KMS, never exportable, rotated annually, predecessor retained seven years for historical verification.
Every Verification Attestation Object carries an append-only, cryptographically linked derivation chain replayable by any party with access to the canonical evidence set. Reliance is verifiable without trusting the issuer.
Every regime below has a documented Statement of Applicability, a control-by-control mapping, and named target dates for independent attestation. We publish dates because institutional procurement deserves a calendar, not an aspiration. Where a certificate is not yet held, we say so.
Ten named sub-processors covering hosting, edge security, source control, observability, secrets management, payments, email delivery, and the agentic-workforce LLM. Each is contracted under a Data Processing Agreement. Material changes are notified fourteen days in advance.
Sub-processor list →Per-customer residency election against the customer's jurisdiction of operation. Cross-jurisdiction transfer requires SCCs 2021 (Module 2 or 3) plus supplementary Schrems II measures, recorded in the Records of Processing Activities.
Tier-by-tier retention schedule under POL-ISMS-04. Crypto-erase, overwrite or physical destruction at end of life with certificate of destruction. Default seven years for institutional reliance evidence; engagement-letter override available.
4-hour RTO and 1-hour RPO for the verification spine. Backup capture cadence aligned to RPO. Quarterly restore test. Cross-region failover tested semi-annually with evidence written to the Compliance Vault.
Four-severity model with named SLAs. Severity 1 includes attestation-key compromise, Vault compromise, material PII breach. 72-hour breach-notification cycle aligned to GDPR Article 33. Tabletop exercise semi-annually.
Append-only derivation chain replayable on supervisory demand. Sealed outputs verifiable against the chain without trusting the issuer. SHA-256 digest on every Vault artefact. HMAC-SHA256 on every Bastion scan.
Audit-ready artefacts and self-assessments are released to procurement offices and counsel under a mutual NDA. Email trust@certisyn.com with your buying-side function and the regimes you need to evidence; we typically respond inside one business day.
Certisyn's controls are layered on top of subservice organisations that independently maintain current attestations. The carve-out method is used in our SOC 2 System Description; Certisyn's own controls are designed to address the user-entity controls referenced by each subservice attestation.
SOC 2 Type 2 attested. Application deployment and edge compute.
SOC 2 Type 2 attested. Managed Postgres and authentication.
SOC 2 / ISO 27001 / FedRAMP Moderate / HIPAA-eligible. Underlying cloud.
SOC 2 Type 2 attested. DNS, edge security, DDoS protection.
SOC 2 Type 2 attested. Source control and CI.
PCI-DSS Level 1 Service Provider. Payment processing.