01
Authorised testing
Testing starts only after scope, hosts, dates, rate limits, write permissions and Rules of Engagement are documented.
// security & trust
Evidence you can review. Controls you can verify.
Kotav Labs delivers authorised security assessments through a controlled engagement model. This page states what we protect, how delivery is governed and where our boundaries are.
KOTAV / TRUST CENTER
Authorised testing
EU-hosted evidence
Reviewed delivery
Tenant separation
// operating safeguards
Security built into the delivery model.
They apply from written authorisation through to reviewed evidence and traceable delivery.
02
EU-hosted evidence
Assessment infrastructure and evidence are hosted in Germany. Subprocessors and any additional processing locations are disclosed per engagement.
03
Reviewed delivery
Material findings receive specialist review. Deliverables use verified evidence and an audit-suitable report, with PDF and SARIF where applicable.
04
Tenant separation
Tenant-scoped access, explicit roles and server-side authorisation protect customer records and operational actions.
05
Account security
HttpOnly sessions, rotating refresh tokens, TOTP MFA, one-time backup codes and encrypted secrets protect browser accounts.
06
Traceability
Assessment jobs, finding changes, retest requests, role changes and sensitive administrative actions produce attributable records.
// scope of service
Clear operational boundaries
Argus Sentinel provides passive intelligence and correlation between assessments. Round-the-clock monitoring and incident response sit outside this service, while certification depends on an independent assessment. Retention, subprocessors, testing permissions and deliverables are agreed for each engagement.
// due diligence
Security review material
A DPA, security FAQ, subprocessor disclosure, sample deliverables and technical answers are available during qualification under appropriate confidentiality terms.
// assurance register
Assurance status and scope.
Each item below states its current scope and status. We identify operating safeguards, voluntary commitments, self-assessments and independent certification separately.
Local evidence reviewed 9 October 2026; external decisions remain separate
01
Security controls operating; certification pendingISO/IEC 27001:2022
Access and MFA, audit telemetry, monitoring, backup operations and branch protection have dated evidence. The ISMS maps 16 risks and 93 Annex A controls. ISO-specific approvals, an executed internal audit, management review and independent certification remain open.
ISO certification guidance02
Internal implementation completeISO/IEC 42001:2023
The scoped AIMS, AI inventory, impact and risk treatment, control mapping, operating evidence, internal audit and management review are complete. Independent accredited certification remains pending.
Read implementation record03
Internal BCMS implementation completeISO 22301
The scoped business-impact analysis, continuity strategies, recovery exercises, supplier dependencies, management review and corrective-action process are implemented. Independent accredited certification remains pending.
Read implementation record04
Control baseline implementedSOC 2 Type II
The scoped control design, ownership and evidence process are implemented. The independent service-auditor examination and Type II report remain pending.
Read implementation record05
Readiness package prepared; closure openNIS2
The internal package maps 12 review areas and 42 evidence sources. Ten closure actions remain, including current operating evidence, management approvals, legal applicability and an independent assessment. No NIS2 certification is claimed.
EU NIS2 overview06
ICT supplier controls implementedDORA
The customer evidence pack covers security, incidents, resilience testing, continuity, subcontractors, audit cooperation and exit support. DORA does not provide a supplier certificate; customer-specific legal validation remains separate.
Read implementation record07
Product controls implementedEU Cyber Resilience Act
Secure-development, vulnerability-handling, dependency, release-evidence and support controls are implemented. Product classification and the applicable legal conformity route remain subject to formal determination.
Read implementation record08
Published self-assessmentCSA STAR Level 1
CSA published Kotav Labs’ CAIQ v4.1 Level 1 self-assessment in the STAR Registry on 14 September 2026. This is a provider self-assessment, not an independent audit.
View CSA listing09
Published self-assessmentCSA STAR for AI Level 1
CSA published the Argus AI-CAIQ v1.1.0 self-assessment in the STAR Registry on 14 September 2026. This is a provider self-assessment, not independent certification or audit.
View CSA listing10
Commitment submittedCREST AI Charter
Kotav Labs submitted its commitment to the nine CREST AI Principles on 5 September 2026. Public listing and the badge remain pending.
CREST principles11
Application package readyMITRE CNA application
The public disclosure policy and advisory index are published, and primary and backup operational contacts are named. Authenticated submission and CVE Program acceptance remain pending.
Public advisory index12
Frameworks in useNIST CSF 2.0 and AI RMF
Scoped current and target profiles structure our internal improvement programme, with evidence reviews tracked against each profile.
NIST CSF13
Methodology adoptedOWASP ASVS 5.0 and SAMM
Assessment and development practices reference selected OWASP requirements and retain review evidence.
OWASP ASVS14
Assessment method implementedNIST SP 800-115 / PTES
Authorisation, scope, discovery, controlled validation, evidence handling, reporting, remediation and retesting follow a repeatable documented method. NIST and PTES do not issue a certificate for this adoption.
Read implementation record15
Official badge issuedCSA AI Trustworthy Pledge
CSA issued Kotav Labs the official 2026 Trustworthy AI Pledge badge. Confirmation of the public directory listing remains pending.
CSA pledge16
Submitted for reviewEU Cybersecurity Skills Pledge
Kotav Labs submitted its pledge and training initiative for platform review on 21 September 2026. The commitment covers free training for at least 25 EU-based developers and security professionals by 30 September 2027; acceptance and publication remain pending.
EU pledge directory17
Commitment activeSME Climate Hub
Registration and email activation were completed on 19 September 2026. The emissions baseline is the next operational task; evidence of a public profile has not yet been recorded.
SME Climate Commitment// what supports a claim
What supports each status.
A policy alone does not prove operation. Public claims require a defined scope, an accountable owner, dated evidence and a recorded review.
01
Authorisation, scope and Rules of Engagement02
Execution and intervention logs03
Evidence provenance and specialist decisions04
Supplier, AI-provider and data-flow reviews05
Recovery, access and change-control records06
Reports, remediation guidance and retest outcomes
