Skip to content
Spineby Bill Gosling
Console

Governance

Standards and Certifications

Continuous compliance posture across the standards that matter to regulated operators. Mapped, monitored and ready for your auditor.

Book a demoExplore the frameworks

Standards

Security and AI standards

International security and AI frameworks mapped to one common control set.

  • SOC 2

    Trust service criteria for security, availability and confidentiality mapped to platform controls.

  • ISO/IEC 27001

    Information security management system requirements aligned to the common control set.

  • ISO/IEC 42001

    AI management system standard for responsible AI development and operation.

  • NIST CSF 2.0

    Cybersecurity framework functions and categories mapped to operational evidence.

  • NIST AI RMF

    AI risk management framework for identifying and mitigating AI-specific risks.

  • PCI DSS

    Payment card industry data security requirements for environments handling card data.

Regional rules

Industry and regional rules

Jurisdiction-specific rules mapped alongside the international standards.

  • FDCPA and Reg F

    Fair debt collection rules and contact frequency limits enforced at the guardrail level.

  • TCPA

    Telephone consumer protection rules including time-of-day and consent requirements.

  • GLBA Safeguards Rule

    Financial institution data protection requirements.

  • DPDP Act

    India's digital personal data protection requirements.

  • GDPR and UK GDPR

    European and UK data protection regulation mapped to platform controls.

  • PIPEDA

    Canadian personal information protection rules.

Monitoring

Continuous monitoring

Posture is checked on a schedule, not once a year before audit season.

  1. Posture runs

    Automated checks against every framework on a schedule.

  2. Regression detection

    Any new gap triggers a finding with the change that caused it.

  3. Quarterly snapshots

    Frozen posture reports for your compliance records.

  4. Compliance briefs

    Executive summaries for board and management reporting.

What we do not claim

Spine maps controls and collects evidence from the platform's own records. Certification is a decision for your auditor about your organisation.

Compliance posture, always current.

Tell us which standards your organisation answers to. We will show the controls, evidence and posture for that set.

Book a demo