ISO 27001:2022
We are building our information security management system (ISMS) to the ISO 27001:2022 standard and are working towards independent certification, covering all cloud and on-premise deployments.
Security & Compliance
Audit-ready security for
critical national infrastructure
Zero-trust architecture and independent penetration testing today, with ISO 27001:2022, SOC 2 Type II, and FedRAMP on our compliance roadmap and GDPR-aligned data handling.
Compliance roadmap
Industry-recognised compliance framework
Our target compliance framework across security, privacy, accessibility, and government cloud standards — certifications in progress, with status available on request.
SOC 2 Type II
A SOC 2 Type II examination is on our compliance roadmap, covering the Security, Availability, and Confidentiality trust service criteria. Reports will be available under NDA for enterprise customers once complete.
FedRAMP
FedRAMP authorisation is on our roadmap for US federal agency customers who require cloud authorisation.
NIST CSF 2.0
Security controls are mapped to NIST Cybersecurity Framework 2.0 across all six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
GDPR Compliance
Data Processing Agreements (DPAs) available for all EU-region customers. Data residency options in Frankfurt, Dublin, and Stockholm. EU SCCs in place for all sub-processors.
WCAG 2.2 AAA
All Airfree web interfaces meet WCAG 2.2 Level AAA accessibility requirements. Regular audits are conducted using automated tooling and assistive technology testing.
Architecture
Security engineered into every layer
Six defence-in-depth controls applied uniformly across SaaS, private cloud, and air-gapped deployments.
End-to-end encryption
TLS 1.3 in transit, AES-256 at rest. Customer-managed keys (CMK) supported via AWS KMS, Azure Key Vault, or HashiCorp Vault for enterprise deployments.
Zero-trust network
Every service-to-service call is mutually authenticated via mTLS. No implicit trust based on network location — identity is verified at every hop using SPIFFE/SPIRE.
RBAC + ABAC
Role-based access control layered with attribute-based policies. Fine-grained permissions down to individual dataset, layer, and feature level using Open Policy Agent (OPA).
MFA everywhere
Multi-factor authentication enforced for all user accounts, service accounts, and administrative interfaces. FIDO2 / WebAuthn hardware keys supported for privileged access.
Immutable audit log
Every data access, configuration change, and administrative action is written to a cryptographically chained audit log stored in write-once object storage. Tamper-evident by design.
Independent pen testing
Independent black-box and grey-box penetration testing is part of our security programme, with findings and remediation timelines shared with enterprise customers.
Need compliance documentation?
We share our current compliance status and roadmap with enterprise customers — including penetration-test summaries, completed security questionnaires, and SOC 2 and ISO documentation as those certifications complete.