Trust builds what is next
Enterprise trust, security and assurance
Secure, governed, operationally ready software for organisations that have to answer to regulators, customers, auditors and boards.
Our ISO/IEC 27001 journey
A disciplined path to certification, with measurable progress. We are not certified yet, and we will publish the certificate and its scope here when we are.
Discipline today
Greater tomorrow
Foundation
Complete
Scope, asset register and risk method defined.
Design
Complete
Policies and controls designed against Annex A.
Implementation
In progress
Controls being embedded in day-to-day operation.
Internal audit
Planned
Independent review ahead of external assessment.
Certification
Planned
External audit. Certificate published here when issued.
Where we actually stand
Our current position, stated plainly
We publish our security posture as it is, not as it will be. This section is updated as our certification and assurance work progresses.
ISO/IEC 27001
Working towards certification
Kernoval is working towards ISO/IEC 27001 certification. We will publish the certificate and scope here once certification is achieved. Until then we make no claim to be certified.
UK GDPR & Data Protection Act 2018
Applied as a legal obligation
As a UK company we process personal data in line with UK GDPR and the Data Protection Act 2018. Our privacy notice sets out the lawful bases, retention and your rights.
Secure development
Practised continuously
Code review, dependency management, secret handling and environment separation are part of our normal delivery process rather than a periodic exercise.
Human oversight of AI
Default posture
Agents prepare and recommend; consequential actions require explicit approval and are logged. Autonomy is granted deliberately, scope by scope.
How we build trust
Security, governance and evidence by design
Controls that exist in the running system, not only in a policy document.
Security by design
Security is built into the platform, the infrastructure and the development lifecycle — not added afterwards.
- Least-privilege access control
- Encryption in transit and at rest
- Tenant and environment isolation
- Secure software development practices
Governance & controls
Operational governance to manage risk, access, data and AI usage responsibly across the organisation.
- Role-based permissions
- Policy-driven approvals
- Documented change control
- Defined data retention rules
Audit readiness
Audit-ready foundations with traceability, logging and evidence capture designed in from the start.
- Activity and access logs
- Data lineage
- Policy enforcement records
- Exportable evidence
Compliance workflows
Policy turned into practice: consistent, repeatable operational controls that run as part of the work.
- Control checklists in-workflow
- Segregation of duties
- Scheduled reviews
- Exception handling
Evidence & assurance
Capture, manage and present evidence for internal review, external audit and regulatory requirements.
- Evidence library
- Report generation
- Regulatory mapping
- Continuous assurance design
Resilient operation
Designed to keep running: environment separation, recovery planning and operational monitoring.
- Backup and recovery design
- Environment separation
- Operational monitoring
- Incident response process
Responsible AI
What we will and will not do
Clear commitments are more useful to a buyer than a statement of values. These apply across every Kernoval engagement.
We will
- Keep a person accountable for consequential decisions
- Log what ran, on what data, approved by whom
- Attribute claims to the sources behind them
- Agree evaluation criteria before go-live
- Tell you plainly where a capability is not ready
We will not
- Train general-purpose models on your data
- Grant agents broader access than the task requires
- Let automated actions bypass your approval rules
- Claim certifications or results we cannot evidence
- Lock your data or workflows into a closed format
Security questions
The questions procurement always asks
Is Kernoval ISO/IEC 27001 certified?
Not yet. Kernoval is working towards ISO/IEC 27001 certification and is building its information security management system against that standard. We will publish the certificate and its scope on this page when certification is achieved.
Where is our data stored and processed?
Deployment region is a decision made with you at the start of an engagement. Kernoval can run in cloud, hybrid or on-premises environments, which allows data residency and sovereignty requirements to be met rather than worked around.
Do you use our data to train models?
No. Customer data is processed to deliver the service you have asked for. Training general-purpose models on customer data is not part of how Kernoval works, and any exception would require an explicit, separate written agreement.
Can agents take action without a person approving it?
Only where you have explicitly configured that. The default is that agents research, draft and prepare, and a person approves anything consequential. Every approval and action is recorded.
How do you handle security incidents?
We maintain an incident response process covering detection, containment, assessment, notification and remediation, including the notification obligations that apply under UK GDPR. Specific commitments are set out in the contract.
Can we run our own security review?
Yes. We expect security review as part of enterprise procurement and will work through your due diligence questionnaire, architecture review and contractual security schedules.
A safer tomorrow
Bring us your security review
We expect due diligence questionnaires, architecture review and contractual security schedules. Send them over and we will work through them properly.