Ta strona jest obecnie dostępna wyłącznie w języku angielskim.
Compliance is a feature, not a cost.
NetSenX is working towards SOC 2 (Type I, then Type II), ISO/IEC 42001 for AI management and ISO/IEC 27001 for information security. None of them is awarded yet; this page states where each one stands, next to the regulations NetSenX supports today: NIS2, GDPR and the EU AI Act.
The Triple Crown
Three certifications. One coherent trust posture.
SOC 2 attests how we operate. ISO 27001 attests how we secure. ISO 42001 attests how we govern AI. Each is audited externally. Together they form an evidence chain a buyer's legal, security, and AI committee can each accept on their own terms.
SOC 2
Type I → Type II
In preparation — not attested yet · Type I target Q2 2026 · Type II Q1 2027
Third-party attestation of security, availability, and confidentiality controls — the universal trust signal for SaaS procurement.
What this gives youISO/IEC 42001
AI Management System
In preparation — no certificate yet · target Q3 2026
Governance, risk, transparency, and lifecycle controls for every AI component in NetSenX — the new global standard for responsible AI.
What this gives youISO/IEC 27001:2022
Information Security Management
Planned — no certificate yet · target Q4 2026
ISMS covering asset, access, cryptography, supplier, incident, BCP, and compliance domains — the EU procurement baseline.
What this gives youAudit calendar
Certification roadmap, 2026 → 2027
Dates are external audit windows, not aspirational targets. Each audit is run by an accredited body. Procurement teams can request an evidence pack at any milestone.
2026 · Q2
SOC 2 Type I audit
External audit firm. Trust Services Criteria: security, availability, confidentiality.
2026 · Q3
ISO/IEC 42001 certification audit
Accredited certification body. AI Management System (AIMS) covering every AI component.
2026 · Q4
ISO/IEC 27001:2022 certification audit
Accredited certification body. ISMS scope covers product, infrastructure, supplier chain.
2027 · Q1
SOC 2 Type II audit
12-month observation period closes. Operating-effectiveness report issued.
2027 · Q2
Triple Crown complete
SOC 2 Type II + ISO 42001 + ISO 27001:2022 — all three live, all three renewable.
What each certification gives you
Three standards, three different governance regimes, three different audit bodies. Each is useful on its own; together they remove almost every reason a procurement team can refuse a deployment.
SOC 2
AICPA Trust Services Criteria
Type I audit-ready Q2 2026 · Type II 2027-Q1
SOC 2 answers the universal SaaS-procurement question: are this vendor's claimed controls actually in place, and do they operate effectively over time? Type I covers design at a point in time; Type II covers a 12-month observation period. We are targeting Type I in Q2 2026 with Type II following one year later.
What this gives your team
- Third-party attestation of security controls (TSC: Security)
- Operating-effectiveness evidence after 12-month observation (Type II)
- Independent CPA report you can hand to procurement and InfoSec on day one
- Renewable annually — no certificate aging issues
ISO/IEC 42001
AI Management System (AIMS)
Audit-ready Q3 2026
ISO 42001 is the world's first auditable AI Management System standard. It is the only certification today that gives a CISO a defensible answer to the question "how do you govern the AI inside your security product?" We adopted it before it was mainstream; we expect EU procurement to ask for it by 2027.
What this gives your team
- Documented governance for every AI component in NetSenX
- AI risk register reviewed quarterly with accountable owners
- Lifecycle controls: introduction, monitoring, retirement
- Direct evidence chain to AI Act Article 50 obligations
ISO/IEC 27001:2022
Information Security Management System (ISMS)
Audit-ready Q4 2026
ISO 27001 is the lingua franca of information security in the EU. The 2022 revision tightened the control set and aligned with NIS2 expectations. Our ISMS scope covers the product, the infrastructure, and the supplier chain — there are no carve-outs that quietly exclude the parts that matter.
What this gives your team
- Statement of Applicability covering Annex A controls
- Asset, access, cryptography, supplier, incident, BCP, compliance domains
- Internal-audit, management-review, and continual-improvement evidence
- EU procurement baseline — accepted by nearly every public-sector tender
EU regulatory readiness
Built for the EU regulatory stack — by people who read the regulations.
The Cyber Resilience Act, NIS2, GDPR, and the AI Act are not branding — they are the four pillars that determine whether an EU mid-market buyer can deploy a product at all. We treat each as a product surface, not a marketing afterthought.
Cyber Resilience Act (CRA)
Article 13 manufacturer obligations · Article 14 vulnerability handling
- The release pipeline generates a CycloneDX Software Bill of Materials (SBOM) for every published release.
- Coordinated Vulnerability Disclosure (CVD) policy live, with a 90-day disclosure window.
- Releases and SBOMs are signed with Sigstore cosign; the signatures sit in the public Rekor transparency log and can be verified independently.
- Vulnerability and incident notification process designed around the CRA 24-hour / 72-hour timeline.
NIS2 Directive
Article 21 cybersecurity risk-management measures
- Evidence is organised by the Article 21 measure families (risk analysis, incident handling, business continuity, supply chain, secure development, cryptography, MFA, training and more).
- Written for both essential and important entities under NIS2 — you keep the regulatory duty, NetSenX supplies the detection and the paper trail.
- Incident workflow that tracks the Article 23 deadlines — 24-hour early warning, 72-hour notification, one-month final report — and prepares each report for you to submit.
- Auditors see the same artefacts your board sees — no separate audit-only version.
GDPR / RODO by design
Data minimisation, EU residency, DPO accountability
- Sensitive fields such as integration credentials are encrypted with AES-256-GCM at the application layer before they reach storage.
- Minimal collection by default — detection works mainly on flow metadata plus a few protocol fields read on the monitored host; encrypted connections are never decrypted.
- EU data residency (eu-west-1) on every paid tier. Customer telemetry and alerts stay in the EU; a few named sub-processors (payments, transactional email) operate in the USA under EU Standard Contractual Clauses.
- DPO contactable at [email protected]. A data processing agreement (GDPR Art. 28) template is published for procurement.
EU AI Act
Article 50 transparency · ISO/IEC 42001 AI management system in preparation
- Public Article 50 transparency disclosure — every AI component, every governance control.
- Risk classification documented: we assess NetSenX as a limited-risk system and apply several high-risk-grade practices voluntarily.
- An AI management system is being built to ISO/IEC 42001 — no certificate awarded yet; target Q3 2026.
- Explanations on every alert and an audit log of who did what are part of the product, not a support request.
Security primitives
The concrete things, not the slogans.
Trust posture is the sum of the controls that survive an auditor's questions. Here are ours.
- AES-256-GCM column-level encryption
- Every sensitive column is encrypted at the application layer before it reaches storage. Keys rotate on a documented schedule.
- Signed releases
- Release artefacts and their SBOMs are signed with Sigstore cosign (keyless, identity-bound), and each signature is recorded in the public Rekor transparency log.
- Customer BYOK
- Business and Enterprise tiers support Bring-Your-Own-Key: customer-held KMS keys gate decryption of customer-scoped data.
- Immutable audit log
- Append-only audit log of every administrative action, every AI-influenced alert, and every data access. 10-year retention on Enterprise.
- EU data residency
- Customer data is processed and stored in eu-west-1 (Ireland). No cross-region replication, no US sub-processor touching customer payloads.
- Sigstore-signed releases
- Every release artefact is signed via Sigstore. Signatures are written to the Rekor transparency log, which any third party can verify offline.
- Public bug bounty
- Researchers can submit findings via Intigriti. Scope, safe-harbor terms, and triage SLAs are public. We pay for valid findings.
- security.txt published
- Standards-compliant security.txt at /.well-known/security.txt with contact, policy, preferred-language and expiry fields.
FIPS 197 / NIST SP 800-38D
Sigstore · Rekor
AWS KMS / Azure Key Vault / on-prem HSM
Tamper-evident, hash-chained
Region pin enforced at the API layer
OIDC keyless signing + Rekor
Coordinated disclosure, 90-day window
RFC 9116
Who builds NetSenX
TriStiX S.L.
The Spanish company that builds and operates NetSenX, from Alicante.
- ISO/IEC 42001 lead implementer on our teamA personal credential for implementing an AI management system. TriStiX S.L. itself holds no ISO/IEC 42001 certificate; that is a Q3 2026 target.
- Company research on arXivTriStiX S.L. research preprint arXiv:2603.28558v1 — multi-valued logic for compliance applications
- Built in-houseDetection engine, agent, dashboard and this site are written and reviewed by TriStiX S.L. — no white-labelled third-party engine
- EU companyTriStiX S.L. — Av. Maisonnave 41, 3º, 03003 Alicante, España · NIF B-26925016
Selected customers
Beta program open
First design partners are signing now. We are intentionally not displaying logos we do not yet have the right to display — when our beta partners ship, they will appear here, named, with their explicit consent.
Need an evidence pack for your auditor today?
Even before our certifications complete, we maintain a procurement-grade evidence pack mapped to SOC 2, ISO 42001, ISO 27001, CRA, NIS2, GDPR, and AI Act controls. Request it under NDA and you will have it the same business day.
Sent to [email protected] and acknowledged within four business hours, EU/Madrid.