Trust & Security
CHARIS is operated by Sicuro Group LLC. This page is an honest snapshot of our security posture and the formal certifications on our roadmap. We update it whenever something material changes.
Aligned
CHARIS provides trigger monitoring aligned to ISO 22301:2019, specifically clauses 8.2 (Business impact analysis and risk assessment) and 8.4 (Business continuity plans and procedures). Assessments are backed by append-only records - posture history, configuration audit log, alert dispatch log, email ledger and fact provenance. This is the product alignment, not a corporate ISMS audit - see ISO 27001 below for that track.
Roadmap · 2026
We are scoping a SOC 2 Type I attestation covering the Trust Services Criteria for Security, Availability and Confidentiality. Internal controls (least-privilege access, encrypted secrets, audit logging, change management) are already operational and documented; the formal third-party audit is planned for the H2 2026 window.
Roadmap · 2026–2027
ISO 27001 certification of the corporate ISMS that operates CHARIS is on the post-SOC 2 roadmap. Sicuro Group LLC's parent organisation already maintains an information-security policy framework aligned to ISO 27001 Annex A controls. Stage-1 readiness review planned for 2026.
Operational
Dependencies are continuously monitored for known CVEs. Application code and infrastructure are scanned on every release. Authenticated penetration tests by an external firm are scheduled annually; the most recent test scope and remediation status are available to enterprise customers under NDA.
Operational
All accounts support TOTP-based two-factor authentication. Enrolment is offered at registration and at every sign-in until enabled, and once enabled the authenticator code is required on every sign-in, including email sign-in links. Session tokens are HttpOnly + Secure cookies, scoped to the application domain. Passwords are hashed with bcrypt and never stored in plain text. Role-based access separates client tenants from admin operators.
Operational
All data is encrypted in transit (TLS 1.2+) and at rest. Customer assessment data is logically segregated per tenant. Personnel re-entry data is intentionally aggregate / anonymised - CHARIS does not require named individuals to deliver re-entry planning. Data export and account deletion are user-controlled.
Please email risk@sicurogroup.com with details and steps to reproduce. We acknowledge reports within two business days. Coordinated disclosure is appreciated.
Sicuro Group LLC · risk@sicurogroup.com · +971 4 362 6378 · Dubai, UAE