Compliance

This is the distinction that almost everybody collapses, and the whole page depends on it, so it is worth stating flatly.

• Security is our own account of what we do. Self-reported. It lives on our Security page, which is also the source of the security measures in our Data Processing Agreement.
• Compliance is somebody else’s verification that we do it. Externally attested. That is this page.

“We encrypt customer data at rest” is a statement for the Security page. “An accredited auditor tested our encryption controls across a twelve-month window and issued an unqualified opinion” is a statement for this one. The first is a description. The second is evidence produced by someone with no commercial interest in the answer.

So this page answers one question, in as few words as it can: who checked, and can we see the report?

The table below is the complete list of the standards a reviewer is likely to ask us about, grouped the way procurement teams usually group them. Nothing in it is held. It is a long table for a short answer, and it is here because knowing which of these apply to us, which do not, and why is more useful than a single “no”.

What “not held” does and does not mean

It does not mean the controls do not exist. Tenant isolation, tenant-scoped authentication, role-based access control, per-user multi-factor authentication and audit logging are all built and running, and Our security architecture links to where they are described in detail.

It means no independent party has tested them and issued a report. Those are two different claims and we are not going to blur them, because blurring them is precisely what a certification exists to prevent.

A certificate is a way of answering a reviewer’s questions without their having to ask. Where we cannot hand over the certificate, we can still answer the questions. This is everything available now, and what is not yet ready, so you can see both at once.

Several frameworks are worth pursuing, and one of them is worth pursuing first. Which one is a commercial question rather than a technical one, and the honest deciding factor is where the revenue is, not which sounds more impressive.

• Selling primarily to UK buyers, including the public sector, the first step is Cyber Essentials, then Cyber Essentials Plus, then ISO 27001. Cyber Essentials is cheap and fast, some government contracts require it, and it is the floor UK buyers most often ask for.
• Selling to larger enterprise buyers, the usual answer is ISO 27001.
• The Software Security Code of Practice self-assessment costs little and UK public buyers are starting to ask for it, so it runs alongside Cyber Essentials rather than after it.
• ISO 27001 and SOC 2 are each six to twelve month projects with real external cost and meaningful internal time. Neither is a document exercise that compresses into a sprint, and we are not going to pretend otherwise on a roadmap.

Our position: Cyber Essentials first, then Cyber Essentials Plus, then ISO 27001, with the Software Security Code of Practice self-assessment alongside Cyber Essentials; SOC 2 Type II only if our buyers require it. Decided on 28 September 2026.

The stages

No stage has a target date yet. Each date will be added here when it is set, and not before: a roadmap with invented dates is worse than one that admits it has none.

Written for the reviewer who has been handed a policy naming a framework and now has to work out what it would actually tell them about us. This section holds no claims about SorviAI at all; every status is in Certification status.

Cyber Essentials and Cyber Essentials Plus

A UK government-backed scheme covering a baseline of five technical control areas. The base level is a verified self-assessment; “Plus” adds hands-on technical testing by an assessor. Both are far cheaper and faster than ISO 27001, and some UK public-sector contracts require one, so it can be the right first step for reasons that have nothing to do with which framework is more rigorous. Certificates last twelve months.

Software Security Code of Practice

Published in May 2025 by the Department for Science, Innovation and Technology and the NCSC. It sets out, in 14 principles, what software vendors should do across secure design and development, build environment security, secure deployment and maintenance, and communication with customers. It is voluntary, and conformance is declared by the vendor itself. Treat a declaration as a statement of intent backed by whatever evidence the vendor offers, not as an audit.

NCSC Cloud Security Principles and G-Cloud

Fourteen principles the National Cyber Security Centre publishes for assessing a cloud service, from data in transit protection to secure use of the service. Public-sector buyers use them to structure their questions, and G-Cloud suppliers describe their services against them. G-Cloud itself is a Crown Commercial Service purchasing framework: a route to market, not a security attestation.

ISO/IEC 27001

Certifies that an organisation operates an information security management system: documented policies, a risk assessment method, a defined set of controls, internal audits and management review. It certifies that security is run as a system. It does not certify that any individual control is strong.

Issued by an accredited certification body after a two-stage audit, then maintained through annual surveillance audits with full recertification every three years. Preparation typically runs six to twelve months and is more a documentation and process undertaking than an engineering one. In the UK, look for a certificate from a body accredited by UKAS.

Its extensions: ISO 27017 adds cloud-specific controls, ISO 27018 adds protection of personal data in a public cloud, and ISO 27701 adds a privacy management system. All three ride on a live 27001 certificate. A vendor citing 27018 without 27001 is describing something that cannot exist.

SOC 2

Not a certification but an attestation: a report produced by a CPA firm on controls measured against five trust services criteria. Security is mandatory; availability, processing integrity, confidentiality and privacy are optional scope. Two reports naming the same framework can therefore cover very different ground, which is why scope is worth asking about.

Type II is substantially harder, substantially more expensive, and the one enterprise buyers mean when they say “SOC 2”. A vendor writing “SOC 2” without the type reads as evasion, and a reviewer will ask.

A SOC 2 report is not a public document. What a vendor publishes is that they hold one; the report itself is released under NDA. A bridge letter covers the gap between the end of the last window and today.

SOC 1, and why it appears here at all

SOC 1 reports on controls relevant to a customer’s own financial reporting, rather than on security generally. It is unusual on a SaaS compliance page and it is on ours because SorviAI holds general ledgers, journals and invoices. If a customer’s external auditor eventually places reliance on our system, SOC 1 is the report they will ask for. It is not in our current scope, and we would rather say that in advance than be surprised by the question.

CSA STAR

A registry run by the Cloud Security Alliance, at three levels: Level 1 is a published self-assessment, Level 2 is a third-party audit built on ISO 27001 or SOC 2, and Level 3 is continuous monitoring. Level 1 entries are free and self-published, so appearing in the registry is not itself a certification, and any vendor presenting it as one is overstating it.

PCI DSS

Applies only to organisations that store, process or transmit cardholder data. It is a scope question before it is a compliance question, and Payments and PCI DSS sets out our scope.

These are laws we are subject to, not audits we have passed. No certificate exists for most of them, and no auditor issues one, so this section is a statement of our position and of what is still missing, with a link to the document carrying the substance.

SorviAI does not currently use an AI provider; if one is added it will be listed as a sub-processor with its transfer basis.

Why none of these rows says “compliant”

“GDPR compliant” as a standalone claim carries almost no information. Nobody certifies it, and a reviewer asking about UK GDPR is not looking for the adjective. They need two concrete things: a data processing agreement, and a lawful mechanism for each transfer. The first is published; the second is set out, transfer by transfer, in the agreement, including the one not yet in place.

So each row points at the document rather than asserting a state. If you find yourself unable to get from a row to the thing it names, that is a fault worth reporting to us, and our contact details are below.

HMRC, Companies House and UK employment law reach into how a product behaves, not only into what its policies say. This section sets out where SorviAI stands for each, including what we do not support, so that you and your accountant can decide how to use the product before you rely on it. It is not tax or legal advice.

Making Tax Digital for VAT

SorviAI Finance keeps VAT records digitally and prepares the nine-box VAT return from the records it holds, then submits the return to HMRC through the Making Tax Digital API after you authorise SorviAI in HMRC’s own sign-in. Boxes 1, 4, 6 and 7 are calculated from your invoices and bills, and boxes 3 and 5 are derived from them. Boxes 2, 8 and 9, which cover goods moved between Northern Ireland and the EU, are always 0. You can make a manual adjustment to box 1 or box 4, with a recorded reason. SorviAI can also read your VAT obligations, liabilities and payments from HMRC, including which obligations are already fulfilled; it cannot read the content of past returns back from HMRC today. Every call carries the fraud prevention headers HMRC requires for our connection method; exactly which ones, and the gaps, are listed on the Security page. HMRC can restrict a vendor’s production access if those headers are wrong, which is why we publish them.

HMRC’s rules require digital links between your records and the return, with no manual copying (VAT Notice 700/22). VAT penalties now run on a points system for late returns and separately for late payment; SorviAI shows deadlines and submission status, but filing on time remains your responsibility. SorviAI does not appear on HMRC’s list of software for Making Tax Digital for VAT (checked on 28 September 2026).

Making Tax Digital for Income Tax

Sole traders and landlords must keep digital records and send quarterly updates and a final declaration to HMRC through compatible software, on this timetable:

SorviAI does not support Making Tax Digital for Income Tax, and there is no current plan to. It sends no quarterly updates and no final declaration. A sole trader who is in scope needs separate compatible software for this, even if SorviAI Finance keeps their books.

Electronic invoicing

The government has announced mandatory electronic invoicing for business-to-business and business-to-government invoices from April 2029, with structured invoices exchanged through accredited service providers. Parts of the public sector, notably the NHS, already accept Peppol invoices. A PDF is not a structured e-invoice. SorviAI Finance produces PDF invoices only: it has no structured e-invoice output, cannot receive structured e-invoices and has no Peppol connection.

Companies House and annual accounts

Companies House has required identity verification for directors and people with significant control since 18 November 2025, and plans to require accounts to be filed through software only from April 2027. SorviAI produces no iXBRL accounts and files nothing with Companies House, or with HMRC for corporation tax. You will need separate filing software or an accountant for those.

Record retention is separate from our backups

A private company must keep its accounting records for three years (Companies Act 2006, section 388), and HMRC generally expects business and VAT records to be kept for six years. That duty is yours, and it continues after you stop using SorviAI. Our database backups are kept for seven days to recover the service after a failure; they are not an archive and do not meet any retention duty. Exports today run per screen or per report, and list exports are capped at 20,000 rows; Nest downloads one file at a time; TeamEmail, Storefront, POS and Escalate have no export; there is no whole-workspace export. Keep your own exports for the statutory period, and do not rely on being able to export everything at once when you leave.

One more point for your records: an invoice that has been sent, or partly paid, can still be edited in place in SorviAI Finance, lines and totals included. If you need the invoice as issued, keep the PDF you sent or export it at the time.

Point of sale

The UK has no fiscal cash-register certification, so no special certificate is needed to use SorviAI POS. General record-keeping rules still apply to your till records. SorviAI POS can show a Daily Summary (Z-report) computed from the day’s sales, but it does not store or seal that report, writes no audit records today and produces no tamper-evident log, so keep your daily totals and records by your own means as well.

Northern Ireland

Under the Windsor Framework, goods moving to and within Northern Ireland follow EU VAT rules, and businesses use XI VAT numbers for them. SorviAI does not support XI VAT numbers today. A VAT registration number with an XI prefix is rejected when you connect to HMRC, and boxes 2, 8 and 9 of the return are always 0. A Northern Ireland business that moves goods to or from the EU cannot file a correct return through SorviAI and needs other software for it.

Worklink and UK employment records

Worklink records employee attendance: check-in and check-out times, the IP address each came from, breaks, hours, overtime, a reason for arriving late, and leave. Working from home is recorded as an approved request rather than on the daily record. Check-in is by kiosk code or by signing in. Worklink also marks employees absent automatically each day when no attendance is recorded; this is an automated step that people review, not a decision made solely by software. Worklink uses no biometrics: no fingerprint, face or other biometric recognition, only an optional profile picture. That matters in the UK because the ICO has taken enforcement action against biometric attendance systems where employees had no real alternative (Serco Leisure, February 2024).

• Working time. Employers must keep adequate records to show they comply with the Working Time Regulations 1998, for two years. Worklink’s attendance records can support that, and the attendance records export (CSV or Excel) carries each day’s times, breaks, hours and overtime; no automatic deletion applies to them.
• Right to work. Employers must keep copies of right-to-work checks for the employment and two years after it ends. Worklink has no right-to-work field or document type. Copies of passports or share-code checks can still be uploaded as general employee documents, but nothing tracks them or applies a retention rule, so keep the official record elsewhere.
• National Insurance numbers and other identifiers. Worklink has no dedicated National Insurance field, so these numbers go into the free-text national ID, tax ID or social security ID fields. Those fields are stored in plaintext and returned in full by the API to anyone with access to employee records; they are not restricted to payroll roles. Detail screens show only the last four characters, but the edit form shows the full value. Grant that access with that in mind.
• Sickness absence. Every workspace that uses Worklink comes with a “Sick Leave” type, and each leave request needs a free-text reason, so illness details can end up in that field. Leave requests can also carry supporting documents such as fit notes. Both are health data, a special category under UK GDPR; ask employees to give no more than you need. Under the Employment Rights Act 2025, statutory sick pay has been paid from the first day of sickness since 6 April 2026, and the lower earnings limit no longer applies.
• Who decides. The employer is the controller for Worklink data and decides what is recorded and for how long; SorviAI processes it on the employer’s instructions.

Storefronts, portals and the Online Safety Act

Storefronts built on SorviAI show the business’s own catalogue and take enquiries, which go only to that business. There is no checkout, no payment and no public user content. Three storefront pages show a file field that sends nothing, although the page tells the visitor the upload worked. Customer and Vendor Portals show each portal user the documents on their own customer or supplier record, including files uploaded by other logins of the same customer and by the business’s staff; portal users can upload documents, and the portals have no ticket view. Repair ticket comments are staff-only; customers never see tickets or comments.

Nest files can be shared by anonymous public link. Public links are on by default and have no rate limit; an administrator can switch sharing off, but that only stops new links, and existing links keep working until each is revoked or expires. That is the one feature that can let content uploaded by one user be encountered by another, so we treat Nest public links as within the Act’s scope and comply: we have recorded an illegal content risk assessment and a children’s access assessment for them, and our director, Deepak Gupta, is the accountable person. There is no moderation tool, reporting form or age check in the product; anyone can report a file shared through a public link by email to [email protected] or through the form on our contact page. Every storefront operated by a UK business still needs that business’s own company details and privacy notice.

Accessibility

The UK did not adopt the European Accessibility Act. Under the Equality Act 2010 service providers must make reasonable adjustments for disabled people, and public-sector bodies must meet WCAG 2.2 AA under the Public Sector Bodies (Websites and Mobile Applications) Accessibility Regulations 2018. A public-sector customer publishing a storefront through SorviAI carries that duty for its storefront. Our storefront templates and admin application have not been audited against WCAG 2.2 AA, and no audit is scheduled yet.

Card numbers never reach SorviAI’s servers. That single fact settles most of what a reviewer needs to know here, but it is worth setting out how, because the difference between “we are compliant” and “we are out of scope” matters and is frequently blurred.

Your SorviAI subscription is paid through Stripe, which is certified as a PCI DSS Level 1 service provider. You enter card details on pages and fields hosted by Stripe, not by us. What SorviAI stores is Stripe’s reference for your customer account and your subscription. When we show your card on the billing page, the brand, last four digits and expiry date are fetched from Stripe for display and are not stored by us. The full card number never reaches our servers, our logs or our backups.

The practical consequence is that our own PCI scope is minimal, in the territory a self-assessment questionnaire covers rather than a full assessment. We state that as a scope position and nothing more.

Payments taken by our customers

Storefronts built on SorviAI take enquiries and have no checkout, so no card data passes through them at all. Separately, a customer can connect its own Stripe account so that its customers can pay its invoices online. That payment happens on Stripe’s own pages, under the customer’s agreement with Stripe, and the money goes to the customer’s own connected account; SorviAI creates that connected account and the charge using its own Stripe platform key, and sends the payer’s email address and the invoice number to Stripe. Card numbers do not reach SorviAI there either, and any PCI scope that arrangement carries is the customer’s, not ours. It is worth asking the question before connecting it.

The third parties with access to customer personal data are listed here, with what they do, where they are and what safeguard is in place, followed by the services your browser loads from third parties while you use SorviAI. This list is the maintained version.

We separate our own sub-processors from integrations you choose to switch on, because the second group works on your instructions under your own agreement with that provider. We announce any change on this page and by email to workspace account owners at least 30 days before a new sub-processor begins handling customer data. Nothing in the product sends that notice automatically, and there is no separate subscription to sign up for. The certifications below are the suppliers’ own, as their sites stated them on 28 September 2026; they are not ours.

SorviAI’s sub-processors

SorviAI does not currently use an AI provider, and no AI provider receives customer data; if one is added it will be listed here with its transfer basis.

Integrations you choose to switch on

These are not our sub-processors. When you connect one, data goes to that provider on your instruction, and your own agreement with that provider governs it.

The application, the database and uploaded files are all in DigitalOcean’s London region, for every workspace wherever the customer is. Data still leaves the United Kingdom in a few ways, each needing a lawful basis of its own, set out below.

The Data (Use and Access) Act 2025 replaced the UK test for international transfers with a “data protection test”: the protection in the destination must not be materially lower than in the UK. Transfers already made under the International Data Transfer Agreement or the Addendum remain valid.

Everything we host is in London today, and the Data Processing Agreement records it: we make no restricted transfer beyond those listed without your authorisation, so moving hosting out of the UK would need your agreement first. We offer no EU data residency; only error reports are processed in the EU.

Why this section carries dates and the others do not

Transfer law has moved repeatedly, through court decisions and successive replacement frameworks, and each move has invalidated arrangements that were correct the day before. The UK itself changed its transfer test in 2025. It is the one part of this page that can become wrong without anything at SorviAI changing and without anybody here noticing.

So the mechanism rows carry the date they were last confirmed, rather than an implied “as at publication”. If a date above is more than a year old, treat it as a question to ask us rather than an answer.

Full detail is on the Security page. The summary here exists because a reviewer arriving at a compliance page holding no certificates deserves to know, in one screen, what is actually running.

Tenant isolation. Every SorviAI customer is provisioned with a dedicated PostgreSQL schema. Customer records are held in separate database schemas rather than in shared tables partitioned by an identifier column, which removes an entire class of cross-tenant query error rather than relying on every query being written correctly. Requests are resolved to a tenant before reaching application code, and authentication tokens are scoped to a single tenant and validated on every request. A token issued for one workspace cannot read another. User accounts, their two-factor secrets and invitations sit in a shared platform schema, because one person can belong to several workspaces.

Authentication and authorisation. Access tokens expire after 60 minutes and are renewed through a refresh flow while you are active. Multi-factor authentication is available to every staff account at the main sign-in, as a time-based code with recovery codes; administrators cannot yet make it mandatory, the two Django administration sign-ins take a password only, and single sign-on is not supported. Within a workspace, access is governed by role-based permissions scoped to each application, so a role granted in Finance conveys no access to Inventory. Administrative rights are tiered rather than binary: workspace administrators manage the whole workspace, application administrators manage only their own application, and everything else is granted per permission against a central registry.

Audit logging. Audit records are written to the tenant’s own schema, so the audit trail is isolated on the same boundary as the data it describes, and kept for the life of the workspace. It cannot be altered through any interface, but it is not tamper-evident against someone with direct database access.

The gaps are on the Security page too

Administrator-enforced multi-factor authentication, the password-only Django administration sign-ins, single sign-on, internal connections that use TLS without certificate verification, the missing Content Security Policy, audit log coverage and tamper-evidence, backup restore testing, recovery targets, dependency and secret scanning, external penetration testing, and the open items in our HMRC fraud prevention headers are all stated there as open, rather than left out.

This is not modesty. A reviewer assumes the worst about an omission and then asks anyway, so the round trip happens either way and the only variable is whether it costs you a week. You will find our gaps faster on our own page than in a questionnaire exchange.

Everything marked public in What we provide instead needs no request at all. For the rest, one address reaches us, and we answer in English.

• Tell us three things. Your organisation, the framework or control set your policy actually names, and your deadline. The third one matters more than people expect: it changes what we prioritise, and we would rather tell you early that we cannot meet it.
• We answer your questionnaire, on your form. We have no policy of responding only to a form of our own, and we do not charge for completing one. If your form asks about a control we do not have, the answer will say so.
• Anything under NDA needs a mutual NDA in place first. Today that applies to nothing, because the documents it would cover do not yet exist. Once a SOC 2 report or a penetration test summary exists, this is the route to it.

Requests reach [email protected], and we respond within 10 working days.

One address for security questionnaires, document requests, and anything on this page you think is wrong. We would rather hear about it than not.

Our full company details are on our company information page.

Data protection contacts

Some of the regimes in Regulations we comply with require a named contact. Where one is required of us, it is listed here.

The regulators

If you are not satisfied with our answer on a data protection matter, you can go to the Information Commission (the ICO), ico.org.uk or 0303 123 1113. Our registration number is ZC254426. Under the Data (Use and Access) Act 2025 you should normally complain to us first; if you remain unhappy, you can then go to the ICO.

Version 1.1 describes the consent banner, affiliate tracking through Tradedoubler, and Session Replay running only with consent. It replaces version 1.0, effective 1 October 2026. Every later version will be published here with its date, and earlier versions will be kept at this address.

The words on this page that carry a specific meaning, in plain language. Several of them are used loosely in vendor marketing, which is the reason they are here.