CAIN-42 CAIN StudioTrust Center
Security, compliance and privacy — stated honestly
This page says exactly where CAIN-42 stands. Where a certification or review does not exist, it says so. No badge is shown that is not held, and results produced on our own machines are labelled as such.
Last reviewed 2026-10-13.
Certifications & frameworks
| Standard | Status | What that means |
|---|---|---|
| SOC 2 Type II | Not certified | Controls are designed and documented; no independent audit has been performed yet. |
| ISO/IEC 27001 | Aligned, not certified | Security practices follow the standard; no certification body has audited them. |
| ISO/IEC 42001 (AI management) | Controls mapped | Controls and evidence are mapped; not certified. |
| EU AI Act | Mapping + WORM evidence | Article 14 (human oversight) and Article 72 (post-market monitoring) are mapped to runtime controls; evidence can be exported to WORM storage. This is a mapping, not a conformity assessment. |
| NIST AI RMF | Mapped | Functions and controls are mapped to CAIN-42 mechanisms and evidence. |
| GDPR | Applies | Processed as a data processor; see sub-processors and the privacy policy. |
| HIPAA / PCI DSS | Not offered | No BAA or PCI program is offered today. |
| Independent security review / pentest | None yet | No third party has reviewed or penetrated CAIN-42. All published results are same-project tests and are labelled so. |
Disclosure, privacy & operations
Vulnerability disclosure
Coordinated disclosure policy, safe harbour and response targets. Read /security or the machine-readable security.txt.
Report a problem
Found an issue in a claim or a bundle? Email security@cainstudio.online. Evidence problems are handled like security reports.
Sub-processors
The current list is at /subprocessors.
Status & uptime
Live component status at /status; live cluster health at /live-cluster.html.
Verification
Every public claim with its evidence and status: the Verification Center, the Proof Center and the Auditor Kit.
What we don't do yet
An explicit list, kept current, at /not-yet.
CAIN-42 keeps authority and evidence separate from opinion: unknown or error never become allow, evidence is never deleted (only superseded), and trust state is derived from evidence, never from a model's opinion of itself. These are runtime invariants, described in the architecture.
Deploy it where you need it
Hosted — CAIN Studio
Multitenant control plane on cainstudio.online. Self-serve, free tier includes the whole decision path.
Self-hosted — MCPGate
The enforcement gate inside your network, so agent traffic and evidence stay with you. See mcpgate.online.
Air-gapped & sovereign
Turnkey deployments with a local KMS root of trust and post-quantum options; advisory and implementation for defence and regulated environments.