Active frameworks
SOC 2 Type 1
AICPA TSC 2017 (rev 2022)
ISO/IEC 27001:2022
2022
GDPR
Regulation (EU) 2016/679
UK GDPR + DPA 2018
2021
HIPAA Security Rule
45 CFR 164.302-318
PCI DSS v4.0
4.0.1 (June 2024)
NIS2 Directive
Directive (EU) 2022/2555
NCA ECC-2:2024
ECC-2 (2024)
UAE IA Standard v2
v2 (2025)
CertiFlow PLUS runs its own compliance programme on this platform. Framework readiness below is illustrative of the shape a live Trust Center takes for customers; a customer’s own Trust Center draws from their tenant’s controls, evidence and audit-chain in real time.
Security posture — what an attacker can take
| Scenario | What an attacker obtains |
|---|---|
| Lawful court order, customer-specific | Ciphertext + plaintext metadata only |
| Production database breach | Ciphertext only at rest |
| Out-of-band backup vault breach | Ciphertext only at rest |
| Compromised CertiFlow PLUS insider with root | Metadata only; cannot decrypt evidence |
Full threat model and ZKE architecture detail: Security page.
Operational posture
Audit chain
SHA-256 hash-chained
Hourly Merkle anchor → S3 Object Lock compliance mode
Documents
- Data Processing Agreement (DPA) — includes Annex III ZKE clauses
- Sub-processor disclosure list — under ZKE, materially shorter than incumbents
- Privacy notice
- Security page — ZKE + 8-layer defence
Need deeper access for an audit?
External auditors can be invited to a read-only Auditor View scoped to the controls in their engagement — every page-view, every comment, every export is recorded in the tamper-evident audit chain. Email shaun@directcs.net with your organisation name and your auditor’s firm name.