In words, with the record each one rests on. Nothing here is a certificate GuardKin holds unless it says held. GuardKin holds none today.
Frameworks
Eight frameworks, in words.
Each line says what GuardKin has on file and what it does not. Where counsel has not signed off, GuardKin does not claim the position.
SOC 2 Type II
In preparationOn file43 criteria mapped and 31 policies written.
Not thereNo auditor, no observation period, no report. A Type II covers at least six months, so there is no date to give.
ISO 27001
PlannedOn fileOn the roadmap, after SOC 2.
Not thereNo certificate, and no date.
PCI DSS
Scoped: SAQ AOn fileA written scope determination: card details go to Stripe, not through GuardKin’s servers.
Not thereGuardKin’s own assessment, not a third party’s attestation.
Regulation Best Interest
A firm’s dutyOn fileGuardKin gives no investment advice and is not a broker-dealer. A matrix maps its features to a firm’s own duties.
Not thereGuardKin does not make a firm compliant, and no counsel has signed off the matrix.
RUFADAA
Counsel questionOn fileThe product is designed to serve as the Act’s “online tool”.
Not thereWhether a designation has statutory priority in a given state is a question for counsel. GuardKin does not claim it.
HIPAA
Not claimedOn fileA vault may hold a medical directive, as sealed bytes the server cannot read.
Not thereGuardKin is not a covered entity and does not claim HIPAA compliance.
CCPA, CPRA and state privacy law
Counsel reviewOn fileA request procedure, in-product self-service and a worker that delivers and erases.
Not thereCounsel has not signed off the statutory position, so GuardKin does not assert compliance.
GDPR
Not offeredOn fileData is stored and processed in the United States.
Not thereNo EU or UK data residency, and no claim of GDPR compliance.
On file
What exists today.
These are GuardKin’s own records. Nothing on this list has been audited by anyone outside the company.
Policies
Exists31 written policies, the first effective April 23, 2026.
MissingNot audited by anyone outside the company.
Controls
Exists43 SOC 2 criteria, each mapped to a policy, evidence and an owner.
MissingNot tested by an auditor.
Vendors
Exists20 vendors, each with a tier, data classes and a review date.
Missing0 of 19 published vendor audit reports collected.
Penetration test
ExistsA scope document for an outside tester.
MissingNo test report.
Restore drill
ExistsA drill plan, and a nightly backup outside the database host.
MissingNo drill on production, so the recovery time is untested.
Cryptography review
ExistsThe protocol is written down and the app’s code is tested against it.
MissingNo outside review has been done.
The 31 written policies.
Information Security Policy · Access Control Policy · Data Classification & Handling Policy · Acceptable Use Policy · Change Management Policy · Incident Response Policy · Business Continuity & Disaster Recovery Policy · Risk Assessment Policy · Vendor Management Policy · Encryption & Cryptography Policy · Vulnerability Management Policy · Data Retention & Disposal Policy · Backup Policy · Logging & Monitoring Policy · Employee Onboarding & Offboarding Policy · Code of Conduct · Password Policy · Remote Work & BYOD Policy · Secure Software Development Lifecycle Policy · AI & LLM Usage Policy · Privacy Policy (Internal) · Breach Notification Policy · Physical Security Policy · Asset Management Policy · Whistleblower Policy · Vendor Management Policy · Risk Management Policy · Policy Management Policy · Emergency Change Procedure · Privacy Procedures · AI Governance Policy
Effective from April 23, 2026. Each has an owner and a version.
Ask about a framework we did not list.
If your review needs a position that is not here, ask. A person answers, and the answer will say “not yet” where that is the answer.