Built for
enterprise standards

No — and strictly speaking, no company is. SOC 2 is not a certification. It is an attestation report issued by a US-licensed CPA firm about a defined service organization, shared under NDA rather than published.

What Axon Active holds is ISO/IEC 27001:2022, the international standard for information security management, certified by an accredited certification body and publicly verifiable. We have been continuously certified since 2018 and hold a current certificate from TÜV Rheinland covering software development, software testing and ICT services.

Both assess an operating control environment rather than a product, and both are evaluated by an independent third party. The differences are in form, assessor and market.

The control overlap is substantial. ISO 27001 Annex A and the SOC 2 Common Criteria address the same underlying areas: access control, change management, incident response, supplier security, logging and monitoring, and business continuity. The difference is largely how the evidence is packaged for the reader.

We maintain a mapping of our ISO/IEC 27001 Annex A controls to the AICPA Trust Services Criteria (Security). It is available to clients and prospects on request under NDA, and lets your security team assess our control environment against the framework they already work with.

We have not undergone a SOC 2 examination and cannot provide a SOC 2 report. Where a client engagement genuinely requires one, we are open to discussing a scoped examination as part of that engagement.

Directly with the certification body, not with us. Our certificate is listed in TÜV Rheinland’s public Certipedia register, which shows the current certificate holder, standard, scope and validity in real time.

Verify on Certipedia →

We deliberately do not host a PDF copy. A live entry in the certifier’s own register is stronger evidence than a file on our website.

13 external onsite audits since 2018, with a 100% pass rate and all findings closed. Certification audits were carried out by SGS from 2018 to 2021 and by TÜV Rheinland since 2021, supplemented by client security audits and audits by Swiss Post and ePost Service AG.

An audit report summary is available on request.

Yes, with the right instruments in place. Vietnam is not covered by an EU adequacy decision, so transfers rely on Article 46 safeguards: the EU Standard Contractual Clauses, attached to the DPA, together with a documented transfer impact assessment and the supplementary technical and organizational measures that follow from it.

Both the SCCs and the TIA are in place before you sign, not negotiated afterwards. The TIA assesses the legal environment at our Vietnam delivery locations and is reviewed annually.

We sign a DPA on every engagement involving personal data. Whether we act as your processor or as your sub-processor depends on your own role — if you are a processor for your customers, we sit beneath you in that chain, and the DPA is structured accordingly.

Our standard DPA template, with the sub-processor list as an annex, is available on request. A member of our compliance team will walk your legal counsel through it.

Yes — VGS Datenschutzpartner GmbH in Hamburg. Contact details are published in our Data Privacy Notice.

Both as standard, not as add-ons.

For UK GDPR, the ICO’s International Data Transfer Addendum is attached to the DPA. For Swiss FADP, we use the FDPIC-recognized Swiss adaptations to the EU SCCs. Switzerland is a home market for us, so Swiss requirements are the default configuration of an engagement rather than something scoped in later.

By default, no. Client data stays in client systems, and our engineers access those systems using credentials your side manages. Where an engagement requires data on Axon Active infrastructure, that is agreed in writing in advance and covered by the DPA.

We use AI-assisted development under our AI Usage Guidelines, on approved tooling only. In client engagements this typically means your tooling, in your environment, under your controls. Where an engagement calls for it, we can run inference on our own infrastructure instead.

Client data is never used to train or improve external models. If your organization restricts AI tooling entirely, we scope that at contracting.

We allocate AI Act roles and obligations per engagement, since the same delivery team can sit in a different position depending on what is being built and who places it on the market. Transparency, human oversight and data quality requirements are built into how we work, and under Article 4 we run AI-literacy training and internal AI Dojos so teams work with AI competently rather than casually.

An EU AI Act alignment statement is available on request.

Yes. Send it to security@axonactive.com — no form, no portal registration. Our Security & Compliance team handles questionnaires directly and typically responds within a few business days.

If it helps to talk first, we will schedule a security review call with the people who actually operate the controls.

Yes. Client security audits are part of our normal audit track record, and audit rights are set out in the DPA. In practice, many clients find that the certification audit reports, the Statement of Applicability and a review call answer their questions without a separate on-site audit — but the option is there.

As your processor, we notify you without undue delay, so that you can meet your own reporting obligations — the 72-hour controller deadline under GDPR, and the equivalent requirements under FADP, Vietnam’s PDPL and other applicable local regulations.

Our incident-response procedures are documented and tested regularly within our certified ISMS.