Trust centre
Certifications and attestations
This page records the status of third-party certifications and attestations for the Baobyte AML Suite. It is a register rather than a badge wall, and its current state is that none is held.
Status register
Every standard, and where it actually stands
Standards that have not been pursued are listed rather than omitted, because an omitted standard reads as an unasked question.
Placeholder — TODO: a human must set the true status of every row in this table. No certification body has been engaged, no audit has been performed, and no certificate reference exists for any row. Replace with sourced, approved content before this page is made public.
| Standard | What it covers | Status | Evidence |
|---|---|---|---|
| ISO/IEC 27001 | Information security management system. | Not claimed | TODO — attach certificate reference, or record “not held” |
| ISO/IEC 27701 | Privacy information management, extending an ISO/IEC 27001 management system. | Not claimed | TODO — attach certificate reference, or record “not held” |
| SOC 2 (Type I or Type II) | Independent report on security, availability, confidentiality and privacy controls. | Not claimed | TODO — attach certificate reference, or record “not held” |
| ISO 22301 | Business continuity management system. | Not claimed | TODO — attach certificate reference, or record “not held” |
| PCI DSS | Payment card data security. Applicability depends on whether cardholder data is ever processed, which has not been formally determined. | Not claimed | TODO — attach certificate reference, or record “not held” |
| Nigeria Data Protection Commission registration | Registration as a data controller or processor of major importance, and the annual compliance audit filing that goes with it, under the Nigeria Data Protection Act 2023. | Not claimed | TODO — attach certificate reference, or record “not held” |
| Independent penetration test | Third-party technical assessment of the application and its deployment. | Not claimed | TODO — attach certificate reference, or record “not held” |
| CSA STAR | Cloud Security Alliance self-assessment or third-party certification. | Not claimed | TODO — attach certificate reference, or record “not held” |
A row on this page will change only when there is a document behind it. That means a named certification body or auditing firm, a certificate or report reference, the scope that was certified — which is rarely the whole company — and the issue and expiry dates. A readiness assessment is not a certification, a gap analysis is not an audit, and a consultant’s letter of opinion is neither.
Instead of a badge
What can be evidenced today
Certification is one form of assurance. In its absence, the useful thing to look at is the control register the product is actually built against — which is deliberately written so that a control cannot be marked accepted without evidence behind it.
The internal compliance control matrix holds twenty-four control objectives covering tenant isolation, authentication and authorisation, maker-checker, service-account handling, field-level encryption, form and storage schema validation, customer lifecycle separation, beneficial-ownership integrity, monitoring explainability, transaction idempotency, watchlist versioning, screening evidence, case closure, report governance, aggregate analytics, the audit chain, retention and legal holds, write-once object evidence, content-pack signing, database privilege separation, backup and recovery, provider contracts, deployment safety and incident handling.
Each row names an accountable owner and the specific evidence required before its status may change — a test result, an audit event sample, a signed pack, a provider contract or an approved policy. Acceptance runs through six gates: design, build, environment, business, operational and release.
The matrix is also explicit that an exception requires an owner, an expiry date, a compensating control and a recorded risk acceptance, and that a green status must never hide an unowned exception. That is the property that makes it worth reading.
The status vocabulary it uses
- Implemented
- Represented in the repository and covered by automated or compile-time checks. It exists and the build proves it exists.
- Implemented / UAT
- Built, and undergoing user acceptance testing. The behaviour is there; the business sign-off that it behaves correctly for the institution is not yet recorded.
- Pending acceptance
- Implementation exists but business, legal, security or operational evidence is outstanding. Most controls in the matrix currently sit here or in the row above.
- Externally dependent
- The contract exists, but a licensed provider, a regulator artefact or a live environment is required before it can be accepted. Screening data and report schemas are the clearest cases.
For your questionnaire
How to answer “is the vendor certified?”
You will have to put something in the box. Here is the accurate wording.
Certification held
None. No security, privacy or continuity certification or third-party attestation is held for this product at the date of this page.
Independent testing
No independent penetration test has been commissioned or completed. Internal threat-driven testing is described on the security page.
What is available
A documented threat model, a twenty-four-objective control matrix with named owners and required evidence, an incident response runbook and a continuity plan. All are vendor documentation, not independent assurance.
If a certification is a hard requirement for your procurement, tell us during the evaluation rather than after. It is a real gap, it has a cost and a timeline, and pretending otherwise wastes both parties’ time. See also the security controls and the availability position.
Procurement
An honest answer beats a fast one
Send us your vendor questionnaire. Where the answer is “no” it will say no, and where a control exists you will get the mechanism rather than an adjective.