Security and compliance roadmap
The standards Banalytics currently uses as reference points and the work still required before formal assurance.
Banalytics is a pre-seed company. This page distinguishes current controls, work in progress and future assurance so that customers can evaluate the product without interpreting a roadmap as a certification.
No certification claim
Banalytics does not currently claim ISO 27001 certification, SOC 2 attestation, formal NIST validation, EU Cyber Resilience Act conformity or a general certification under the GDPR or EU AI Act.
References to a law or framework describe the control model being used to organise work. They do not state that an authority, auditor or certification body has verified Banalytics.
EU and United States readiness
| Area | Current position | Next evidence |
|---|---|---|
| GDPR | Applied to website and Portal processing; local Agent data remains with its owner | Internal processing register, supplier review and pilot DPA execution |
| EU Cyber Resilience Act | Readiness programme; no present conformity claim | SBOM, support-period statement, signed updates, vulnerability process and technical file |
| EU AI Act | Optional third-party model connectors and local showcase modules are being classified | Module cards, intended-purpose boundaries and contract-specific role assessment |
| NIST CSF 2.0 | Used as the structure for the company security programme | Documented current and target organisational profiles |
| NIST SSDF | Used as a reference for secure software development improvements | Documented secure development lifecycle and repeatable security checks |
| US privacy | Privacy requests and browser privacy signals are supported; applicability is monitored | State-law applicability register and incident notification matrix before material US activity |
Public trust documents
Pilot-specific review
A production pilot is not treated as an anonymous Community installation. Before a pilot starts, Banalytics and the customer should document the deployment boundary, data categories, support-access method, responsible contacts, external services, security assumptions, incident communications and any contract-specific validation or service commitments.
Contact info@banalytics.live to request a deployment-specific review.
Last updated: 23 July 2026.