Compliance

Evidence your reviewer can check without trusting us.

INTYGA is not a compliance product. It produces one artifact — a human signature bound to the exact parameters of an action — and several frameworks ask for that artifact in different vocabulary. These pages say which requirement each control helps satisfy, what evidence it leaves behind, and where the mapping stops.

Start free Read the security architecture

What this is not

We hold no certification and no attestation. INTYGA is not ISO 27001 certified and holds no SOC 2 report. ISO 27001 is the active track and the work is underway; until a certificate exists, everything published here is a control mapping. An ISMS owner will check the certificate register, and they should.

No regulation requires what we sell. The EU AI Act requires effective human oversight and the ability to demonstrate it. It does not mandate cryptographic proof, and no vendor can sell you conformity with a regulation. Neither can NIS2 or DORA be discharged by a purchase — engaging a vendor does not transfer the regulated entity's obligations. A vendor may separately be in scope in its own capacity. A control can support an obligation; it is never a substitute for one.

A mapping is an argument, not a verdict. These pages show which requirement each control helps satisfy. Your auditor decides whether it does, and your Statement of Applicability decides whether the control applies to you at all.

By framework

⚖️ EU AI Act

Article 14 human oversight — and what it does not require.

📋 ISO/IEC 27001

Annex A.8.32 change management, evidenced with a signature.

🛡️ NIS2

Selected Article 21(2) controls: privileged-action authorization and step-up.

🏦 DORA

Article 9(4) ICT change management for financial entities.

🗂️ SOC 2

CC6.1 and CC6.8, for US buyers who ask in these terms.

The part you do not have to take on faith

The reason to publish a mapping at all is that the controls behind it are checkable by the person reading it. Three of them a security team can confirm in an afternoon, without talking to us.

Verify a receipt yourself

Install @intyga/verify, take any approval receipt, and confirm offline that a human signed exactly the action that ran. No INTYGA secret, no network call, no account. Node 18 or newer.

Read the requester and approver apart

Filter the ledger for AUTHZ_APPROVED and read requesterType, approverType and approvalMode. A machine requested and a human approved, or a policy auto-approved — the record says which, and never conflates them.

Export the evidence bundle

GET /audit/evidence returns committed leaf preimages, per-entry inclusion proofs against a sealed checkpoint, and the per-tenant sequence commitment that makes an omission detectable. The export exists on every plan including the free one — verifiability is not an upsell — though how far back you can export follows your plan's retention window.

The strongest claim we have is a negative one.

INTYGA holds no key capable of producing a valid approval — not as a policy we promise to keep, but because no such key exists on our side. Every mapping on these pages rests on that, which is why a reviewer can check it without believing anything we say.

See how that is enforced →