Compliance

Last updated: 27 May 2026

At a glance

deny.sh holds one externally verified certification today (Cyber Essentials) and documents controls aligned to two further standards (SOC 2 Type II, ISO 27001) without yet engaging an independent auditor. The supporting controls include: audit chain with signed receipts, durable usage metering, customer-controlled encryption keys (BYOK), pre-built integrations (Secrets Manager custodian, signed outbound webhooks, company sign-in (SAML SSO)), and this compliance documentation. A third-party cryptographic audit of the construction is on the roadmap. We track every claim against where you can verify it. See also the Trust centre for a scan-friendly summary and the controls map below for the SOC 2 and ISO 27001 mapping.

Controls map

Every SOC 2 Trust Services Criterion (TSC 2017 with 2022 Points of Focus) and every ISO 27001:2022 Annex A control category, linked to supporting deny.sh documentation or controls, with a link to the verifiable artefact. Implementation status follows the same vocabulary as the table above: Operating means shipped and running in the production deployment today; Documented means policy and procedure exist but rely on an attestation we have not yet engaged; Planned means roadmap, not yet implemented. This is the public index. The full controls pack (policies, evidence files, incident runbook, vendor pack) is shared under NDA on procurement engagement.

If you are mapping deny.sh against an internal vendor risk framework not listed above (HITRUST CSF, NIST CSF, CMMC, ENISA, ISMAP, IRAP, etc.), tell us which controls your reviewer is asking about and we will return the mapping. We will confirm whether the available evidence covers your requirements.

Cyber Essentials

Cyber Essentials is the UK government-backed baseline assurance scheme operated by the IASME Consortium. It covers five technical controls: boundary firewalls, secure configuration, user access control, malware protection, and security update management. It is an annual certification with a written self-assessment scored against IASME's assessor question set. Our scope was the deny.sh production sub-set, including the droplet operator and the production application surfaces; out-of-scope items (research hardware, unrelated personal devices) were excluded per IASME's documented carve-out rules.

The certificate is recorded on the BlockMark Registry and verifiable by the certificate ID above. Renewal falls on 15 May 2027. A standard certificate includes £25,000 of cyber liability insurance via Sutcliffe & Co, bundled with the IASME issuance.

UK GDPR and DPA

Treehouse in Valhalla Ltd is the UK data controller for the deny.sh service. The privacy policy sets out the lawful bases for processing, the categories of personal data handled, retention periods, and the rights customers have under the UK GDPR and Data Protection Act 2018. A Data Processing Agreement is published at /dpa and can be incorporated into commercial contracts on request.

International transfers are addressed in section 8 of the privacy policy: where data is replicated outside the UK, transfers rely on UK-US Data Privacy Framework adequacy regulations or the UK International Data Transfer Addendum to the EU SCCs.

SOC 2 Type II controls

We maintain a controls documentation pack aligned to the SOC 2 trust services criteria (security, availability, confidentiality). The pack covers access management, change management, encryption at rest and in transit, vulnerability management, vendor management, incident response, and business continuity. The controls are operating today; they have not yet been examined by an independent SOC 2 auditor, and we will not describe them as "audited" or "certified" until they have been.

An independent SOC 2 Type II examination is on the roadmap; dates not yet announced. No engagement date is announced. When the engagement begins, this page will be updated with the firm name, the audit window, and the expected report date. Until that engagement exists, we describe the posture as "controls documented and operating", not "audit in progress".

ISO 27001 Annex A mapping

The same controls documentation pack maps our operational policies against the ISO/IEC 27001:2022 Annex A controls. The mapping is internal evidence that we have thought through each control category; it is not a certification, and we will not describe it as one. Formal ISO 27001 certification is on the roadmap; dates not yet announced.

Independent cryptographic audit

The deny.sh construction (Argon2id key derivation, AES-256-CTR encryption, XOR composition) is documented in the whitepaper with a prose companion at /security and a threat model at /threat-model. We have not yet commissioned an independent cryptographic audit of the construction or the reference SDK implementations. We expect to engage a credentialed cryptography firm post-launch on a scope covering the primitive, the byte-compatible reference SDKs (TypeScript, Rust, Go, Python), and the hosted API. When the engagement is firm, we will publish the firm name, the scope, and the expected delivery date on this page and on /security. Results will be published in full when complete; we will not redact findings.

Until then, the evidence available is: the construction in plain text (/security), the whitepaper (/whitepaper), the open-source reference implementations (github.com/deny-sh-crypto), and the published reproducible-build and SRI manifest (/verify).

Penetration test

No external penetration test has been commissioned to date. A third-party penetration test is planned alongside the other assurance work, covering the public web surfaces, the hosted API, and the SDKs in their default integration mode. We will publish the firm and date when commissioned, and a summary report (with operational specifics redacted only where necessary) when complete.

Procurement pack

If you are evaluating deny.sh for an enterprise procurement, write to hello@deny.sh. Where a specific procurement is in scope, we assemble and share the following items under NDA. We don't publish a pre-built pack: the contents are tailored to the controls, jurisdictions, and tier in scope for the engagement, and assembled fresh against the current operational state when requested.

• SOC 2 Type II controls documentation
• ISO 27001 Annex A mapping
• Internal vulnerability management policy and recent scan summary
• Vendor and subprocessor list with locations and roles
• Incident response runbook (redacted operational specifics)
• Business continuity and disaster recovery plan
• Data residency matrix per plan tier

We will not describe a pack as already assembled until an engagement is open against it. The pack is prepared for the specific procurement engagement.

Include your procurement deadline in the email.

How to interpret this evidence

SOC 2 produces an independent examination report, not a certification. No completed report is claimed here. We will not describe an audit as "in progress" until we have signed an engagement letter. We will not list a partner certification (HIPAA, PCI DSS, FedRAMP) on the strength of an aligned subprocessor; the certification belongs to the entity audited, not to a vendor downstream of it. The point of this page is that you can read every claim above and verify each one without taking us on faith.

Contact

Compliance questions, procurement requests, or audit scoping discussions: hello@deny.sh. Security findings: security@deny.sh (see /disclosure for the coordinated policy and GPG key).