Current assurance status
Roadmap references on the website are future intentions. They must not be read as completed audits, legal advice, or permission to process regulated data.
| Framework | Everock status |
|---|---|
| SOC 2 Type II | No independent report available. No completed audit is claimed. |
| ISO 27001 | Not certified. An assessment and any certification program remain to be established. |
| HIPAA | No BAA available. Do not use the beta for protected health information. |
| GDPR and regional privacy laws | Readiness requires operator identification, legal bases, rights processes, provider review, and transfer arrangements where applicable. This is not a certification. |
Controls available in the product
- Authenticated project scoping and separately authorized integration and agent access.
- SDK collection controls, consent state, sanitization, custom filtering, and optional masked replay.
- Configurable retention and operational resource limits.
- Source and runtime evidence that remain separate permissions and data flows.
Providers depend on your deployment
This is a product dependency overview, not a list of contracted subprocessors. Providers that are not enabled do not automatically receive data. Telegram, SMS, and other delivery channels require their own configured provider paths; a landing illustration does not establish delivery.
Before production processing, record the actual legal providers, purposes, data categories, regions, contracts, and transfer safeguards. A self-hosted customer is responsible for its own deployment inventory.
| Category | Implementation dependency |
|---|---|
| Authentication | Supabase Auth for the supported production dashboard configuration. |
| Database and queues | PostgreSQL and Redis; the hosting operator chooses where they run. |
| Replay storage | Configured object storage or a supported local storage directory. |
| Repository access | GitHub, when a user authorizes a repository integration. |
| Email delivery | Resend, when email delivery and a sending identity are configured. |
| External agent | The coding agent and provider the customer chooses and authorizes. |
What must be finalized
- The service operator’s identity, legal and privacy contacts, and effective contractual terms.
- A current hosting and subprocessor register, processing locations, and applicable transfer arrangements.
- Retention, export, deletion, backup, and restoration procedures verified against the deployed service.
- Incident response, monitored support channels, and any separately agreed service levels.
- Independent assurance evidence before making certification or audit claims.
Policies and agreements
The current legal pages are beta drafts for review. They describe intended terms and the boundaries of the implemented product. An overview page does not execute an SLA, DPA, BAA, or international transfer agreement.
