Is DebriefCore SOC 2 certified?

No. DebriefCore is not SOC 2 audited or certified. We maintain internal SOC 2 readiness documentation against the AICPA Trust Services Criteria, but we have not completed a formal audit — and we will not claim a certification we do not hold.

Is DebriefCore ISO/IEC 27001 certified?

No. DebriefCore is not ISO/IEC 27001 certified. We track information-security-management-system (ISMS) readiness against ISO/IEC 27001:2022 as an internal baseline. Certification requires a formal audit by an accredited body, which we have not completed.

Is DebriefCore GDPR compliant, and can I get a DPA?

We maintain privacy and data-handling documentation, but we do not claim GDPR or CCPA compliance without independent legal review. Organizations that need a Data Processing Agreement (DPA) can request one at hello@debriefcore.com.

What security and compliance frameworks does DebriefCore follow?

DebriefCore maps its controls to recognized baselines: NIST CSF 2.0 (mapped baseline), OWASP ASVS Level 1 (readiness), SOC 2 (readiness — not audited), and ISO/IEC 27001 (readiness — not certified). These are readiness baselines that guide our security program, not certifications.

Does DebriefCore use my data to train AI models?

No. DebriefCore sends content to AI providers through their API tiers, which are not used to train the providers' public models. Reference photos are never sent to any AI model, Boardroom answers come only from your approved knowledge, and your knowledge base stays owned by your organization.

Enterprise

Trust you can check.

Governance, ownership and access, stated plainly — including what DebriefCore is not. Every claim on this page is one your security reviewer can verify.

DebriefCore Trust Record

Live

Status: Production
Model: Human-reviewed, draft-until-approved
Access: Authenticated workspace access
Data: Organization-scoped controls
Claims: Roadmap, not certification

Operational status

Roadmap — Not Certification

Trust summary · built toward recognized best practices, not a certification.

Who can see your data

Organization-Level Data Isolation: Organization-scoped access controls mean each workspace can only reach its own captures, outputs, knowledge articles, and Context Packs. Row Level Security is enforced at the database layer.
Secure Authentication: Real workspaces require authenticated access. Anonymous visitors can explore demo content, but they cannot generate real outputs or write production data.
Private Reference Files: Reference photos are stored privately per organization and viewed only through short-lived signed links. They are source material for human reviewers — never sent to any AI model, and never included in data exports.

Who owns it

Your organization owns its approved knowledge. It is exportable, it is not training data, and reference photos never reach any AI model at all.

Data controls, with their real status

Approved-knowledge export (JSON / CSV)Available
Data deletionPlanned
Retention controlsPlanned
Subprocessor listPlanned
Regional data considerationsPlanned
Multilingual privacy noticesPlanned
Independent legal reviewNeeds Legal Review

What the AI is allowed to decide

Nothing. AI output is a draft until a qualified person approves it, and the trail of who did what is append-only.

Human Review First: Every generated output stays a draft until a qualified person reviews and approves it. DebriefCore does not auto-approve outputs, certify readiness, or replace instructor judgment, mechanic authority, or official procedures.
Draft-Only Generation Guardrails: DebriefCore organizes a debrief into structured drafts from user-provided information. By design it must not invent facts, claim official compliance, auto-approve content, or bypass human review.
Audit Logging & Accountability: Key actions — captures, AI draft generation, human approvals, governance decisions, reference-file uploads, and data exports — are recorded in an append-only activity log. Owners and admins can review who did what, and when.
Knowledge Lifecycle Governance: Approved knowledge does not sit unchecked. Every article carries a governance status — Current, Needs Review, Stale, Superseded, or Archived. A daily automated check marks overdue articles as stale. Every governance action writes an append-only revision entry that cannot be edited through the application UI.

What we are — and are not — certified for

These are readiness baselines that guide our security program. They are not certifications, and we will not describe them as any.

NIST CSF 2.0Mapped Baseline
DebriefCore's controls are mapped against the NIST Cybersecurity Framework 2.0 (Govern · Identify · Protect · Detect · Respond · Recover). Protect is strongest. Incident response and monitoring gaps are documented.
OWASP ASVS Level 1Readiness In Progress
Application security controls are mapped against OWASP ASVS Level 1. Authentication, access control, and data protection controls are strong. MFA for admin accounts and standardized input validation are priority gaps.
SOC 2 SecurityNot Audited
Working toward SOC 2 Trust Services Criteria (Security). Technical controls are solid; policy documentation and incident response are the critical path. Audit engagement not yet initiated.
ISO/IEC 27001Not Certified
Building toward ISO/IEC 27001:2022 ISMS readiness. Technology controls are well-addressed. ISMS foundation — scope, risk assessment, Statement of Applicability, and formal policies — has not yet been established.
Privacy & GDPRLegal Review Required
Privacy documentation, data subject rights workflows, subprocessor list, and customer DPA are in progress. Independent legal review is required before any GDPR or CCPA compliance representation.
FAA SMS-Style Safety LearningNot FAA-Approved
DebriefCore's knowledge capture and debrief workflow aligns with safety-learning principles. It does not integrate with FAA SMS or ASAP programs, and does not substitute for any regulatory safety management requirement.

What DebriefCore does not claim

Not SOC 2 audited
Not ISO/IEC 27001 certified
Not GDPR legally reviewed as compliant
Not HIPAA-ready for PHI
Not FAA-approved
Does not replace official safety, training, or maintenance systems
Does not auto-approve AI-generated outputs

The questions reviewers ask

Is DebriefCore SOC 2 certified?: No. DebriefCore is not SOC 2 audited or certified. We maintain internal SOC 2 readiness documentation against the AICPA Trust Services Criteria, but we have not completed a formal audit — and we will not claim a certification we do not hold.
Is DebriefCore ISO/IEC 27001 certified?: No. DebriefCore is not ISO/IEC 27001 certified. We track information-security-management-system (ISMS) readiness against ISO/IEC 27001:2022 as an internal baseline. Certification requires a formal audit by an accredited body, which we have not completed.
Is DebriefCore GDPR compliant, and can I get a DPA?: We maintain privacy and data-handling documentation, but we do not claim GDPR or CCPA compliance without independent legal review. Organizations that need a Data Processing Agreement (DPA) can request one at hello@debriefcore.com.
What security and compliance frameworks does DebriefCore follow?: DebriefCore maps its controls to recognized baselines: NIST CSF 2.0 (mapped baseline), OWASP ASVS Level 1 (readiness), SOC 2 (readiness — not audited), and ISO/IEC 27001 (readiness — not certified). These are readiness baselines that guide our security program, not certifications.
Does DebriefCore use my data to train AI models?: No. DebriefCore sends content to AI providers through their API tiers, which are not used to train the providers' public models. Reference photos are never sent to any AI model, Boardroom answers come only from your approved knowledge, and your knowledge base stays owned by your organization.

What you can run it on

Deployment and AI-routing options, each with its real availability.

Bring your own AI provider & keyOn request
Route AI to your own OpenAI account/key instead of the platform default. Keys are handled server-side as secret references — never stored in plaintext, never sent to the browser.
Azure OpenAI & AWS Bedrock routingRoadmap
Run draft generation and Boardroom answers on Azure OpenAI or AWS Bedrock in your own cloud tenant/region. The provider abstraction is in place; these backends are planned, not yet live.
Customer-owned storage & exportOn request
Discuss customer-owned storage and structured export of approved knowledge so your organization keeps a portable copy of its governed knowledge base.
Private-cloud deploymentEnterprise
Private-cloud / dedicated deployment patterns are available as custom enterprise engagements. Scoped per organization.

Reviewing DebriefCore for your organization?

The Security & Trust Packet carries the control detail, framework mapping and gap documentation your reviewer will want.

Security & Trust Packet Talk to us