Trust Center
Security, on the record.
The public register of the controls, statuses and boundaries SharkNet maintains — every status backed by a dated record, nothing claimed before it is done.
- Controls
- 15
- Access tiers
- 3
- Severity levels
- 5
- Supply chain
- 6
Access tiers
Who sees what.
- 01
Public tier
Real policies in summary, security contact, service and BCP model, confirmed certification status with date, subprocessors within an approved scope.
No login. No secrets, credentials or exploitable findings.
- 02
Client tier
Completed questionnaire, applicable DPA/SLA/BCP summaries, evidence index, current restore and control summaries.
Verified client, limited to their tenant scope.
- 03
Restricted evidence room
Redacted penetration summary or report, detailed risk and control mapping, approved assurance documents.
NDA or legal basis, owner approval, defined term and download audit.
Control register
Every control, with its status.
Every control starts as planned. A verified status is entered only after actual execution with a dated record.
- SEC-01Scope, asset inventory and data flowsServices, boundaries, owner, location, criticality and dependencies.planned
- SEC-02Risk managementMethod, risk owner, treatment, residual risk and deadline.planned
- SEC-03Access and joiner/mover/leaverMFA, roles, least privilege, quarterly reviews, partner access removal.planned
- SEC-04Secure development and changeThreat model, review, CI gates, release authority, rollback and approvals.planned
- SEC-05Vulnerability and supply chainInventory, dependency/image/IaC scanning, patch SLA, SBOM and exceptions.planned
- SEC-06Incident and notificationSeverity, channels, owner and deputy, evidence, contractual and legal deadlines.planned
- SEC-07Backup, DR and BCPBIA, RPO/RTO, backups, off-site or immutable options, founder-absent drills.planned
- SEC-08Suppliers and subprocessorsDue diligence, DPA, regions, on-call scope, exit and annual reassessment.planned
- SEC-09Data retention and deletionCategories, basis, term, export, backup expiry and legal holds.planned
- SEC-10Encryption and secretsTLS, encryption at rest per system, key ownership, rotation and recovery.planned
- SEC-11AI governanceApproved models, data and tools, eval, prompt-injection defence, human review.planned
- SEC-12Logging and monitoringAudit scope, time sync, redaction, retention, tamper resistance and alerts.planned
- SEC-13Awareness and confidentialityTraining for the founder and partner operators, NDA and incident exercises.planned
- SEC-14Internal audit and management reviewSeparate competent review, corrective actions and management decisions.planned
- SEC-15Assurance mappingStatement of Applicability on the ISO path; mapping to SOC criteria on the SOC path.planned
Severity targets
How fast we respond.
Proposed targets, stated as targets — not as a measured service level.
| Priority | Triage | Remediation |
|---|---|---|
| Actively exploited critical or public secret | Immediately, P1 process | Containment immediately; plan and action within 4 hours on a covered Enterprise tier; fix as fast as possible with a tested rollback |
| Critical without proven exploitation | Within 1 working day; P1 on exposure | Within 72 calendar hours of confirmation |
| High | Within 2 working days | Within 14 calendar days |
| Medium | Within 5 working days | Within 30 calendar days |
| Low | Scheduled review | Within 90 calendar days |
Penetration testing
Independent testing.
- Scope
- Dashboard and API, tenant isolation, authentication, sessions and recovery, approvals, exports, integrations and relevant cloud configuration.
- Rules
- External qualified provider, written authorisation and defined scope. Staging testing uses synthetic data; production checks are limited and explicitly authorised. The test is not replaced by our own AI scan.
Supply chain
- Approved registries, pinned dependencies and base images
- SBOM for our own release artifacts
- Secret, SAST, SCA, IaC and container scanning
- Licence checks
- Restricted build identities
- Provenance and signing or verification of artifacts where the pipeline supports it
Programme stage
Where we are.
Now
M1–M3: scope, risk and control register, owners, policies, public status and draft vendor-assessment answers.
Next
M3–M6: core controls implemented, portal test, partner and restore drills, first real evidence records.
Not promised
No certification or report is promised to a date before scope is fixed, control history exists and audit readiness is achieved.
Questions about security?
We do not currently claim ISO 27001 certification or a SOC 2 report.