Standards
The assurance roadmap.
A date on every step, the ones procurement reviews ask for first. Each moves to done here, and on the datasheets, as it ships.
| Step | What it gives you | Date |
|---|---|---|
| Disclosure policy and security.txt | A published way to report a flaw, our response times, and advisories with CVE numbers (ISM-1616, ISM-1717) | November 2026 |
| Incident notification | Affected customers told within 24 hours of our confirming a flaw or incident, inside APRA's 72 | November 2026 |
| Secret scanning | Every commit checked for keys and credentials, and refused if it holds one (ISM-2030) | November 2026 |
| Software bill of materials | A CycloneDX bill of materials and build provenance with every release (ISM-1730, ISM-2056) | December 2026 |
| Hardening guide and support policy | Every setting, its default and the risk of changing it; supported releases and notice periods (ISM-1798, ISM-2053) | December 2026 |
| Independent penetration test | An accredited tester's report, under NDA, then a new test every six months | March 2027 |
| Passkeys | Phishing-resistant sign-in to the console (ISM-1682) | March 2027 |
| SIEM-ready events | A published event catalogue and a standard syslog format | March 2027 |
| Single sign-on | Sign in through your own identity provider (OIDC, SAML) | June 2027 |
| ISO/IEC 27001 certification | Our information security management system certified by an accredited body | September 2027 |
Quantum-safe cryptography has its own roadmap, complete for everything we control by December 2027.