Security and compliance posture
AI-SDLC is built for regulated environments. This page maps its controls to common standards and states exactly what is and is not certified.
Certification status
As of 2026-10-27, AI-SDLC and its operator, ReliableGenius Inc, hold no third-party security certification such as SOC 2 or ISO 27001. The framework maps its controls to those standards so that adopters can run it inside their own certified environments. We will pursue a certification when an enterprise adopter requires it. We do not commit to a date without that demand.
Statement dated 2026-10-27.
Control mapping
The standards column names the theme a control addresses. It is a mapping, not a claim of certification or audited conformance.
| Control | What the framework does | Standards themes | Documentation |
|---|---|---|---|
| Tamper-evident audit trail | Append-only, hash-chained audit log with pluggable sinks records agent actions. | ISO 27001 logging and monitoring; SOC 2 monitoring of system operations | Audit reference |
| Sandboxing, credentials and kill switches | Sandboxed execution, just-in-time credential issuance, kill switches and approval workflows. | ISO 27001 access control; SOC 2 logical access | Security reference |
| Restricted agent actions | Runtime governance blocks dangerous operations such as merging PRs, force-pushing or deleting branches. | ISO 27001 privileged access and change control; SOC 2 change management | Action governance reference |
| Repository-owned rules | Each repository declares its own hard rules for agents in version-controlled configuration. | ISO 27001 policies for information security; SOC 2 control environment | Per-repo governance |
| Signed evidence that a review ran | A signed Merkle root over reviewer transcripts is committed next to the code and verifiable against any historical commit. | ISO 27001 change management and evidence; SOC 2 change management | Proof of execution |
| Independent review | Reviewers run on infrastructure the implementer cannot influence, and on a different harness. | ISO 27001 segregation of duties; SOC 2 change management | Reviewer independence |
| Untrusted contributor verification | Pull requests from untrusted contributors are verified without privilege escalation or credential exposure. | ISO 27001 secure development; SOC 2 logical access | Zero-trust PR verification |
| Decisions made before code is written | A Definition-of-Ready gate refuses tasks whose open decisions the operator has not answered. | ISO 27001 secure development lifecycle; SOC 2 change management | Definition-of-Ready gate |
Reporting a vulnerability
See our security.txt.