Evidence, not a certificate.
Kodela is not certified against any framework and has not been audited.
| Framework | Certified | In progress | Customer-configured | Not certified | Not mapped or n/a | Status | What exists |
|---|---|---|---|---|---|---|---|
| SOC 2 | Not currently certified | Evidence report maps technical controls to TSC CC6.1–6.7, CC7.2–7.3, CC8.1 | |||||
| ISO 27001:2022 | Not currently certified | Evidence report maps to Annex A (e.g. A.5.15–5.18, A.8.15–8.16, A.8.20–8.21, A.8.24, A.8.32) | |||||
| NIST SP 800-53 r5 | Not certified(not a certification scheme) | Evidence report maps IA-2, IA-5, AC-2/3/6/12, AU-2/3/6/7/9, SC-7, SC-7(5), SI-4, SC-8, SC-28, CM-3 | |||||
| GDPR | Supported through customer configuration(self-hosted: you are the controller and the processor; Kodela processes no personal data) | No mapping. We believe no DPA is needed while self-hosted; that position has not been legally reviewed yet | |||||
| EU AI Act | Not mapped | The authorship record and audit are relevant building blocks, not compliance | |||||
| HIPAA | Not applicable / not mapped | n/a | |||||
| PCI DSS | Not applicable | n/a | |||||
| DORA, NIS2 | Not mapped | Evidence report controls may support your own assessment | |||||
| FedRAMP | Not applicable(no cloud service) | n/a |
Certified and in progress are empty on purpose: none held, none in progress.
What it gives you is evidence from the running system: a report that scores 13 technical controls against ISO 27001, SOC 2 and NIST 800-53, a hash-chained audit trail you can verify, and a record of which pushes an agent wrote. Your organisational controls (risk, people, suppliers, premises, continuity, incident response) remain yours, and the report says so.
- Certificates held
- none
- In progress
- none
- Audited
- no
- Evidence report
- 13 technical controls · 6 yours
What the report checks
Every finding comes from running a check against the live system: the firewall is read from iptables, the chain is re-walked, the iteration count is read from a real account.
| Control | Verdict | ISO 27001:2022 | SOC 2 TSC | NIST 800-53 r5 | Evidence observed |
|---|---|---|---|---|---|
| IDENTUnique per-user identification | PARTIAL | A.5.16 Identity management | CC6.1 | IA-2 | 3 user(s) have individual credentials, but the shared front-door credential is still accepted |
| AUTHNAuthenticator strength & storage | MET | A.5.17 Authentication information | CC6.1 | IA-5 | PBKDF2-HMAC-SHA256, per-user salt, weakest account at 200000 iterations |
| ACCTAccount provisioning & disablement | MET | A.5.18 Access rights | CC6.2, CC6.3 | AC-2 | 3 account(s) in a relational store with an enabled flag |
| AUTHZAccess enforcement / least privilege | MET | A.5.15 Access control | CC6.1 | AC-3, AC-6 | all 2 workspaces have an enforced owner link |
| SESSSession management & revocation | MET | A.5.15 Access control | CC6.1 | AC-12 | sessions are recorded with a jti and revocable on demand |
| LOGSecurity event logging with attribution | MET | A.8.15 Logging | CC7.2 | AU-2, AU-3 | 184 record(s); 171 carry a user id |
| LOGINTAudit record protection (tamper evidence) | MET | A.8.15 Logging | CC7.2 | AU-9 | append-only JSONL, SHA-256 hash-chained per record; the chain verifies |
| LOGREVAudit review, analysis and reporting | MET | A.8.16 Monitoring activities | CC7.2, CC7.3 | AU-6, AU-7 | exports as CEF, LEEF, syslog, JSON and CSV |
| NETNetwork boundary protection | MET | A.8.20 Networks security | CC6.6 | SC-7 | DOCKER-USER DROP is installed and verified closed |
| EGRESSOutbound traffic control & monitoring | PARTIAL | A.8.21 Security of network services | CC6.6 | SC-7(5), SI-4 | egress proxy is in 'observe' mode: decisions are logged but not enforced |
| SECRETSecrets management | PARTIAL | A.8.24 Use of cryptography | CC6.1 | IA-5(7), SC-28 | brokered: anthropic; other provider credentials are not brokered |
| TLSEncryption in transit | NOT MET | A.8.24 Use of cryptography | CC6.7 | SC-8 | the door serves plain HTTP: no TLS front end declared |
| CHGChange management | PARTIAL | A.8.32 Change management | CC8.1 | CM-3 | changes are version-controlled; review and approval gates are a process control, not evidenced by this tool |
| Organisational | Cannot be evidenced by code. Listed so the gap is visible, never counted as a pass. | ||||
| RISKRisk assessment & treatment | ORG | A.5.7 Threat intelligence / Clause 6.1 | CC3.1-CC3.4 | RA-3 | Not evidenced by code: a policy, process or physical control an auditor assesses directly. |
| HRPersonnel screening, onboarding, training | ORG | A.6.1-A.6.6 | CC1.4 | PS-3, AT-2 | Not evidenced by code: a policy, process or physical control an auditor assesses directly. |
| VENDORSupplier / third-party risk management | ORG | A.5.19-A.5.22 | CC9.2 | SR-3 | Not evidenced by code: a policy, process or physical control an auditor assesses directly. |
| PHYSPhysical & environmental security | ORG | A.7.1-A.7.14 | CC6.4 | PE-3 | Not evidenced by code: a policy, process or physical control an auditor assesses directly. |
| BCPBusiness continuity & tested recovery | ORG | A.5.29-A.5.30 | A1.2 | CP-2, CP-4 | Not evidenced by code: a policy, process or physical control an auditor assesses directly. |
| IRIncident response plan & exercises | ORG | A.5.24-A.5.28 | CC7.4, CC7.5 | IR-4, IR-8 | Not evidenced by code: a policy, process or physical control an auditor assesses directly. |
Synthetic: example verdicts for a fresh install with defaults, not a real run. The control IDs and mappings are the report’s own. The report never folds ORG rows into MET.
Who evidences what
The report covers what a program can measure. An auditor assesses the rest with you.
The report evidences · 13
IDENTIdentificationAUTHNAuthenticationACCTAccount managementAUTHZAuthorisationSESSSessionsLOGLoggingLOGINTLog integrityLOGREVLog reviewNETNetworkEGRESSEgressSECRETSecretsTLSTLSCHGChange management
Yours · 6
RISKRisk assessment and treatmentHRPeople: screening, onboarding, trainingVENDORSuppliersPHYSPremises and physical securityBCPContinuity and tested recoveryIRIncident response
Backups help, but continuity is yours. bin/backup is encrypted and restorable; nothing schedules it, and there is no restore runbook.
Before an audit
Run the report, fix the NOT MET controls, run it again. Attach the HTML and the audit-log verify output to the evidence request.
Certification. None held, none in progress. SOC 2 and ISO 27001 audit an organisation over a period; the report is evidence such an audit can use. If your procurement requires a certified supplier, Kodela cannot meet that today.
$ compliance-report --framework soc2 --html report.html
$ compliance-report --framework soc2 --failures-only
$ audit-log verifyWhat the report is not
It reads the host it runs on. For what that host still leaves open, read the known gaps.
- Not a certificate. This is evidence for your audit.
- Kodela itself is not certified, and has not been audited.
- No mapping yet for the EU AI Act, GDPR, HIPAA or DORA.
- A point in time. Each run reflects the configuration at that moment; nothing schedules it.
- The record trusts host root. Tamper-evident, not tamper-proof.
- GDPR position not legally reviewed. Treat the row above as our reading, not advice.
Bring your auditor's questions
The report runs on your own host, against your own configuration. A pilot is where to start.