Controls that support your program, stated plainly.
Compliance belongs to your organization, not to a product. Data.co provides technical controls and evidence that map to common regulatory and framework expectations. This page explains that mapping, what remains your responsibility, and the status of our own attestations.
Data.co attestations: not yet published.
Data.co has not yet published a SOC 2 report, ISO/IEC 27001 certificate, HITRUST certification, FedRAMP authorization, or other third-party attestation. Status will be posted here.
Where Data.co controls are designed to help.
A summary of control areas. It is not a legal analysis and not a substitute for your own assessment.
| Framework | Relevant expectations | Data.co controls that support them |
|---|---|---|
| HIPAA Security Rule | Access control, audit controls, minimum necessary | Policy by role and purpose, PHI labels, local audit log |
| GDPR | Data minimization, purpose limitation, transfer restrictions | Label-based minimization, purpose conditions, local processing |
| SOC 2 (your environment) | Logical access, change management, monitoring | Policy as code with review, access decisions logged, audit export |
| ISO/IEC 27001 Annex A | Access control, logging, supplier relationships | Identity-based policy, tamper-evident logs, no content to vendor |
| NIST AI RMF | Govern, map, measure, manage AI risks | Model catalog and approval, usage records, policy enforcement |
| NIST SP 800-53 / 800-171 | AC, AU, and CM control families | Attribute-based access, audit records, configuration as code |
What remains yours.
Because Data.co runs in your infrastructure, the physical, network, and host security of that infrastructure is yours, along with identity provider configuration, the policies you write, the people you grant access to, and how you review the audit log. Decisions about lawful basis, business associate relationships, and data subject rights are also yours.
Data.co is responsible for the software behaving as documented, for the security of app.data.co and the Marketplace, and for the commitments in our agreements, including a business associate agreement or data processing addendum where applicable.
Evidence your auditors can request from your deployment.
- Exported policy set with version history
- Policy test results from CI
- Audit log extracts for a sampled period
- Model catalog with approval records
- Approval workflow records with approver identity
- Classification rule history
Records produced as a side effect of normal operation.
Evidence is most credible when nobody had to assemble it for the audit. These records exist whether or not an auditor ever asks.
Policy history
Every policy change is a commit with an author, a reviewer, and test results. Activation of a policy set is itself an audited event with a content hash.
Decision records
Each access decision is logged with subject, resource, action, outcome, policy IDs, and policy set version, so a sampled request can be tied to the exact rules in force.
Approval trail
Approvals record who asked, who decided, when, and the note they left. An approver cannot approve their own delegated request.
Hosted-plane exports
Organizations can export their app.data.co audit log as CSV and download a compliance evidence bundle for the active organization.
Bringing Data.co into an existing audit scope.
- 1
Describe the component
Add the runtime to your system description: where it runs, which data it brokers, and which identity provider it trusts.
- 2
Map your controls
Point your existing access, logging, and change-management controls at the policy repository, the audit log, and the release process.
- 3
Sample the period
Export audit segments for the sample period and verify the hash chain before handing them over, so completeness is demonstrated rather than asserted.
- 4
Show the tests
Provide policy test results for the period, including the cases that prove sensitive requests were denied.
Frameworks for AI risk ask for inventory and accountability.
Guidance such as the NIST AI Risk Management Framework, and emerging AI regulation in several jurisdictions, tends to ask the same practical questions: which AI systems are in use, who is accountable for each, what data they can reach, and how their use is monitored. Those questions are hard to answer when models are called directly from many applications.
Routing model and tool access through Data.co's gateways gives one place to answer them. The model catalog records owner and approval status, policies record what each identity may send to each model, and decision records show actual use. Which rules apply to your organization, and how to classify your AI systems under them, are questions for your counsel.
Questions buyers ask
Is there a HIPAA certification for Data.co?
There is no official HIPAA certification for products. Data.co is designed to support HIPAA safeguards, and a business associate agreement is available where Data.co services involve PHI.
Will Data.co pursue SOC 2?
Attestation plans and status will be posted on this page. We do not claim any attestation that has not been completed and published.
Does running Data.co put it in scope for our audits?
Likely yes, as a component of your environment. Its policy, audit, and configuration records are designed to be usable as evidence in that scope.
Do you offer a DPA?
Yes. A draft data processing addendum is available for review, covering the limited personal data processed by app.data.co and the Marketplace.
Can Data.co help with GDPR data subject requests?
Data.co does not hold the content in your deployment, so requests about that content are handled in your source systems. Because the audit log is content-free, it rarely holds more personal data than identity and request metadata.
Who signs agreements on Data.co's behalf?
Nead, LLC, an Arkansas limited liability company doing business as Data.co, is the contracting party for licenses, the DPA, and any business associate agreement.
See it against your own use case.
A 30-minute technical walkthrough, policy simulation on your scenarios, and a deployment recommendation for on-prem, private cloud, or hybrid.