Heramind publishes the boundary between implemented controls, tested demo evidence and open production gates. This is a control programme, not an ISO certificate.
Application permissions, transaction-bound tenant context, restricted PostgreSQL runtime roles and row-level security are covered by automated tests.
Legal and processing agreements, verified recovery evidence, enforced MFA or passkeys, mailbox security, independent penetration testing and a signed pilot scope remain gates.
The control library is being mapped toward relevant ISO 27001 information-security practices, privacy obligations and secure-development evidence. Heramind is not presented as certified until an accredited certification exists.
Ask for the current trust pack and we will distinguish verified evidence from roadmap items.
