Compliance is part of the product, not an extra.
NetSenX is preparing for a SOC 2 Type I report, ISO/IEC 42001 for AI management and ISO/IEC 27001 for information security. None of them is awarded yet; this page states where each one stands, next to the regulations NetSenX supports today: NIS2, GDPR, the Cyber Resilience Act and the EU AI Act.
Standards in preparation
Three standards, each with its own external audit
SOC 2 reports on how we operate controls, ISO/IEC 27001 on how we manage information security, ISO/IEC 42001 on how we govern AI. Each will be audited by an independent body; together they give a buyer's legal, security and AI reviewers evidence each can accept on its own terms.
SOC 2
Type I
In preparation — not attested yet · no audit date set
An independent attestation that security, availability and confidentiality controls are designed as described: the trust report most SaaS procurement teams ask for.
What this gives youISO/IEC 42001
AI management system
In preparation — no certificate yet · no audit date set
Governance, risk, transparency and lifecycle controls for every AI component in NetSenX, under the international standard for AI management systems.
What this gives youISO/IEC 27001:2022
Information security management
Planned — no certificate yet · no audit date set
An information security management system covering assets, access, cryptography, suppliers, incidents, business continuity and compliance.
What this gives youCertification roadmap
The order of work
None of these certifications is awarded yet and no audit is booked, so we show the order of the work, not dates. A date appears here only once an audit is booked with an independent auditor. Procurement teams can request our evidence pack at any time.
Step 1 · in preparation
SOC 2 Type I audit
By an independent audit firm. Trust Services Criteria: security, availability, confidentiality.
Step 2 · in preparation
ISO/IEC 42001 certification audit
By an accredited certification body. The AI management system covers every AI component.
Step 3 · planned
ISO/IEC 27001:2022 certification audit
By an accredited certification body. Planned scope: product, infrastructure and supplier chain.
Step 4 · planned
SOC 2 operating-effectiveness report
Only after the controls have run through an observation period.
Goal
All three in place
SOC 2, ISO/IEC 42001 and ISO/IEC 27001:2022. None is awarded today.
What each standard gives you
Three standards, three governance regimes, three audit bodies. Each is useful on its own; together they answer most of the questions a procurement team asks before approving a deployment.
SOC 2
AICPA Trust Services Criteria
In preparation — Type I · no audit date set
SOC 2 answers the standard SaaS-procurement question: are this vendor's controls actually in place as described? A Type I report covers the design of the controls at a point in time. We are preparing for it; no audit date is set yet.
What this gives your team
- Independent attestation of security controls (Trust Services Criteria: security)
- A report from an independent CPA firm you can hand to procurement and InfoSec, once issued
- A fixed scope you can compare with other vendors' reports
- A scope statement that names exactly which systems the report covers
ISO/IEC 42001
AI management system
In preparation — no certificate yet · no audit date set
ISO/IEC 42001:2023 is the first international standard for AI management systems. It gives a CISO an auditable answer to the question "how do you govern the AI inside your security product?". We are building NetSenX's AI management system to it.
What this gives your team
- Documented governance for every AI component in NetSenX
- An AI risk register with named owners, reviewed on a fixed schedule
- Lifecycle controls: introduction, monitoring, retirement
- A direct evidence chain to the EU AI Act Article 50 transparency duties
ISO/IEC 27001:2022
Information security management system
Planned — no certificate yet · no audit date set
ISO/IEC 27001 is a common requirement in EU procurement. The 2022 revision reorganised the Annex A controls into four themes: organisational, people, physical and technological. The planned scope covers the product, the infrastructure and the supplier chain.
What this gives your team
- A Statement of Applicability covering the Annex A controls
- Asset, access, cryptography, supplier, incident, continuity and compliance controls
- Internal audit, management review and continual-improvement evidence
- A baseline many EU procurement processes ask for
EU regulations
Built for the EU regulatory stack, by people who read the regulations.
The Cyber Resilience Act, NIS2, GDPR and the AI Act decide much of what an EU buyer must check before deploying a security product. We treat each one as part of the product, with the evidence to show for it.
Cyber Resilience Act (CRA)
Article 13 manufacturer obligations · Article 14 reporting
- The release pipeline generates a CycloneDX Software Bill of Materials (SBOM) for every published release.
- A coordinated vulnerability disclosure policy is published, with a 90-day coordinated disclosure window.
- Releases and SBOMs are signed with Sigstore cosign; the signatures sit in the public Rekor transparency log and can be verified independently.
- The vulnerability and incident notification process is designed around the reporting duties of Regulation (EU) 2024/2847, Article 14.
NIS2 Directive
Article 21 risk-management measures · Article 23 reporting
- Evidence is organised by the Article 21 measure families: risk analysis, incident handling, business continuity, supply chain, secure development, cryptography, multi-factor authentication, training and more.
- Written for essential and important entities: you keep the regulatory duty, NetSenX supplies the detection and the paper trail.
- The incident workflow tracks the Article 23 deadlines — 24-hour early warning, 72-hour notification, one-month final report — and prepares each report for you to submit.
- Auditors see the same records your board sees; there is no separate audit-only version.
GDPR by design
Data minimisation, EU residency, a reachable DPO
- Sensitive fields such as integration credentials are encrypted with AES-256-GCM at the application layer before they reach storage.
- Collection is minimal by default: detection works mainly on flow metadata plus a few protocol fields read on the monitored host, and encrypted connections are never decrypted.
- Customer data is stored in the EU: the database in Ireland (AWS eu-west-1), the API in Frankfurt and Paris. A few named sub-processors (payments, transactional e-mail) operate in the USA under EU Standard Contractual Clauses.
- The DPO is reachable at dpo@netsenx.com, and a data processing agreement under GDPR Article 28 is published for procurement.
EU AI Act
Article 50 transparency · ISO/IEC 42001 AI management system in preparation
- A public Article 50 transparency disclosure lists every AI component and its governance controls.
- The risk classification is documented: we assess NetSenX as a limited-risk system and apply several high-risk-grade practices voluntarily.
- An AI management system is being built to ISO/IEC 42001; no certificate is awarded and no audit date is set.
- An explanation on every alert and an audit log of who did what are part of the product, not a support request.
Security controls
The concrete things, not the slogans.
A trust posture is the sum of the controls that survive an auditor's questions. Here are ours.
- AES-256-GCM field-level encryption
- Sensitive fields are encrypted at the application layer before they reach storage.
- Signed releases
- Release artefacts and their SBOMs are signed with Sigstore cosign (keyless, identity-bound), and each signature is recorded in the public Rekor transparency log, where anyone can verify it.
- Append-only audit log
- Administrative actions, AI-influenced alerts and data access are written to an append-only audit log, available on every plan, Free included.
- EU data residency
- Customer data is stored in the EU: the database in Ireland (AWS eu-west-1), the API in Frankfurt and Paris. Every sub-processor, with its location and transfer safeguard, is listed in the data processing agreement.
- Coordinated vulnerability disclosure
- Researchers report to security@netsenx.com. We acknowledge within 2 business days, decide on triage within 5, and coordinate public disclosure within 90 days.
- security.txt published
- A standards-compliant security.txt at /.well-known/security.txt with contact, policy, preferred-language and expiry fields.
FIPS 197 / NIST SP 800-38D
Sigstore · Rekor
Tamper-evident, hash-chained
Database: AWS eu-west-1
Published disclosure policy
RFC 9116
Who builds NetSenX
TriStiX S.L.
The Spanish company that builds and operates NetSenX, from Alicante.
- ISO/IEC 42001 lead implementer on our teamA personal credential for implementing an AI management system. TriStiX S.L. itself holds no ISO/IEC 42001 certificate; its AI management system is in preparation.
- Company research on arXivTriStiX S.L. research preprint arXiv:2603.28558v1 — multi-valued logic for compliance applications
- Built in-houseThe detection engine, the agent, the dashboard and this site are written and reviewed by TriStiX S.L.; there is no white-labelled third-party engine
- EU companyTriStiX S.L. — Av. Maisonnave 41, 3º, 03003 Alicante, España · NIF B-26925016
Design partners
Beta programme open
We do not display customer logos we have no right to display. When design partners agree to be named, they will appear here, with their explicit consent.
Need an evidence pack for your auditor?
Before any certification completes, we maintain an evidence pack mapped to SOC 2, ISO/IEC 42001, ISO/IEC 27001, CRA, NIS2, GDPR and AI Act controls. Request it under NDA and we send it to you directly.
Requests go to dpo@netsenx.com, the address of our data protection officer.