Frameworks
Mapped to the rules
you answer to.
One catalog of controls underneath every framework, so a single check counts everywhere it applies. Your company profile switches on only the frameworks that are yours.
- Art. 5(1)(c), Art. 25Data minimisation and privacy by defaultOnly personal data necessary for each purpose is processed by default; no profiling without a valid basis.
- Art. 12–14Transparent information to data subjectsData subjects receive concise, accessible information about the processing at the time data is collected.
- Art. 28Processors bound by contractProcessing by a processor is governed by a contract containing the Art. 28(3) clauses.
- Art. 30Records of processing activitiesThe controller maintains a record of processing activities under its responsibility.
- Art. 32Security of processingAppropriate technical and organisational measures ensure a level of security appropriate to the risk.
- Art. 33–34Personal data breach notificationBreaches are notified to the supervisory authority within 72 hours and to data subjects when high risk.
- Art. 35Data protection impact assessmentHigh-risk processing is preceded by a DPIA.
- Art. 44–49Transfers outside the EU/EEATransfers of personal data to third countries rely on adequacy, appropriate safeguards or a derogation.
- Art. 5(3)Prior consent for non-essential storage and accessNon-essential cookies and similar technologies are only used after the user's freely given, specific and informed consent.
- Art. 5(3); Garante 2021 §7Consent banner with equal accept and rejectA consent mechanism lets users accept or reject non-essential trackers with equal ease, and withdraw consent later.
- Art. 5(3); Garante 2021 §6Clear and comprehensive information on cookiesA cookie policy lists the cookies and trackers used, their purpose and duration.
- WSB-1Encrypted transportAll traffic is served over HTTPS with HSTS and no mixed content.
- WSB-2Browser hardening headersSecurity headers restrict script sources, MIME sniffing, framing and referrers.
- WSB-3Secure cookiesCookies are protected from interception and cross-site misuse.
- WSB-4No information leakageResponses do not disclose server software versions.
- WSB-5Vulnerability reporting contactSecurity researchers can find how to report issues via security.txt.
- SRP-1Changes are reviewedThe default branch is protected and code ownership is defined.
- SRP-2Dependencies are managedDependencies are locked and updated automatically.
- SRP-3CI pipelines are hardenedActions are pinned and the CI token has least privilege.
- SRP-4Secrets stay out of sourceSecret scanning is enabled and no credential files are committed.
- SRP-5Project policies are publishedThe repository declares its license and a vulnerability disclosure policy.
- Annex I Part II (1)Identify and document components (SBOM)Manufacturers identify and document vulnerabilities and components, including a software bill of materials.
- Annex I Part II (2)Address and remediate vulnerabilities without delayVulnerabilities are remediated promptly, including through security updates.
- Annex I Part II (5)–(6)Coordinated vulnerability disclosure policy and contactA coordinated vulnerability disclosure policy is in place and a contact address for reporting is published.
- Annex I Part I (2)(f)Protect integrity of the productCode and build pipelines are protected against unauthorised modification.
- DPR 633/1972 art. 35VAT number on the websiteBusinesses with a VAT number show it on the homepage of their website.
AI ACT · EU 2024/1689
Coming nextAI Act readiness
Your company profile already records whether you build or use AI. The AI Act is the next framework we are adding. It will cover:
- An inventory of the AI features you build or use
- Their likely risk class under the AI Act
- Transparency duties, such as telling people they are talking to an AI
- Evidence kept next to your GDPR records
Ready when the auditor is
Don't tell them you're compliant.
Show them.
Book 30 minutes. We scan your own site live and show you what an auditor would flag.