Our security page says we are not ISO 27001 certified. That is true and it is the easiest sentence in the world to write, so here is the harder version: all 93 Annex A controls, where The Art of Service Pty Ltd actually stands on each one, and the reason for every verdict.
15 of them we do not meet at all. They are listed by name below, not summarised away. If you are evaluating us and one of them matters to you, you now know before you talk to us rather than after.
Inherited means a named sub-processor operates the control and we rely on them; each row says which one. Claiming Hetzner's datacentre perimeter as our own control would be the kind of overstatement this page exists to avoid. Partial mostly means the thing happens but nothing about it would survive an auditor asking for evidence. Reviewed 20 August 2026.
Public commitments exist in the security statement, DPA, privacy policy and terms. There is no internally approved information security policy set, and no review cycle for one.
Roles are unambiguous because the team is very small, but they are not written down or formally assigned.
Not achievable at this size. The same person develops, deploys and administers production. Compensating controls are version control and an audited deploy path, not separation.
Management and operations are the same people, so direction is not the constraint; documented evidence that it happened is.
The company is registered with the OAIC regime as an Australian entity and the DPA carries a 72 hour notification commitment. No standing contact is maintained with a CERT.
No membership of a security forum or industry special interest group.
No threat intelligence feed is consumed. Dependency advisories arrive through GitHub only.
Security is considered in change design, but there is no project methodology gate that records it.
The estate is small and fully known: three servers, one graph database, one Redis, one frontend host. There is no maintained asset register.
No acceptable use policy has been issued.
No employees hold company assets that would be returned. Contractors have no issued equipment.
Customer compliance data and account data are treated as the sensitive classes and separated in handling. The scheme is not documented.
No labelling scheme exists.
Transfers to sub-processors are over TLS and each is covered by the DPA, which names them, their purpose, the data they see and their location.
Access to production is restricted to one operator by SSH key. There is no documented access control policy behind that.
Platform identities are unique per account, issued through SSO or password registration, and API keys are per account and revocable.
Passwords are hashed and API keys are secrets shown once. Accounts not using SSO have no second factor, which the security page states plainly.
Rights are provisioned and removed by the one operator. There is no periodic review of who holds what, because there is one holder.
Every sub-processor is named publicly with purpose, data and location, and adding one requires 30 days notice under the DPA.
The DPA binds us to our customers. We rely on each provider's standard terms upstream rather than negotiated security schedules.
The ICT supply chain is short and named. Component and dependency provenance is not formally assessed beyond GitHub advisories.
No scheduled review of sub-processor security posture takes place. Changes are noticed reactively.
Cloud use is deliberate and documented publicly, and data residency is stated. There is no cloud security policy governing the choice.
A 72 hour breach notification commitment exists contractually and a reporting address is published with a two business day acknowledgement. There is no tested incident plan.
Events reaching the operator are assessed. There is no defined triage criteria or severity scheme.
Response would be immediate and by one person. It is not documented or rehearsed.
Defects found in operation are written up in detail and the reasoning is kept, which is where the learning goes. This is engineering practice rather than a security incident review.
No forensic evidence handling procedure exists.
The platform degrades rather than fails: the frontend serves cached content when the API is unreachable. There is no continuity plan for the company.
Daily database dumps with seven day retention support recovery. Single region, and restore has not been exercised on a schedule.
Australian law and GDPR obligations are identified and carried into the DPA and privacy policy, which are published.
Third party standards are referenced, never reproduced. Where a licensed copy is not held the platform says so rather than publishing text it does not have the right to.
Records are retained in the database and backups. There is no records retention schedule beyond the 30 day deletion commitment.
Personal data handling is set out in the privacy policy and DPA, with deletion within 30 days on request and written confirmation, and no model training on customer data.
No independent review of information security has been commissioned. No penetration test, no audit, no attestation.
There are no internal policies to check compliance against.
Operating procedures for deploy, restore and release are written and followed, in the repository rather than in a controlled document set.
No hiring has taken place under the current operating model.
Contractual terms exist for the people involved. They do not carry explicit information security responsibilities.
No security awareness training programme exists.
No disciplinary process is defined for security breaches.
No terminations to manage under the current operating model.
Confidentiality obligations flow through customer contracts and the DPA. There is no standing NDA regime for personnel.
All work is remote by default from a small number of known devices. There is no remote working policy.
A published reporting address with a two business day acknowledgement, and an explicit commitment not to pursue good faith reporters.
Datacentre perimeter is operated by Hetzner Online GmbH in Germany. We hold no facility of our own containing platform data.
Physical entry control is Hetzner's.
Facility security is Hetzner's. No company office holds platform data.
Physical monitoring is Hetzner's.
Environmental threat protection is Hetzner's.
We operate no secure areas.
No clear desk or clear screen practice is defined or enforced.
Server siting and protection is Hetzner's. Workstations are not covered by any equivalent control of ours.
Work happens on a small number of known personal devices with full disk encryption. There is no off premises asset control.
No removable media is used for platform data. This is practice, not policy.
Power and cooling are Hetzner's.
Cabling is Hetzner's.
Server hardware maintenance is Hetzner's.
Secure disposal of server hardware is Hetzner's. We have no equivalent process for our own end user devices.
End points are few, known and disk encrypted. There is no endpoint management, no enforced configuration and no mobile device policy.
Privileged access is one operator holding one SSH key. Concentration rather than control: there is no approval or review of privilege.
Access to customer data is restricted per account and enforced in the API. Paid artefacts are bound to the purchasing token rather than to a guessable identifier.
Source is in a private repository with access limited to the operator; deploys run from a pinned remote with a fast forward only merge.
SSO through Google or Microsoft inherits the customer's own MFA. Password accounts have no second factor, stated plainly on the security page.
Capacity is monitored informally and the estate is far below its limits. There is no capacity plan or alerting threshold.
No anti malware runs on the servers. The workload is a database, an API and a reverse proxy with no user file execution, which is a reason and not a control.
Dependency advisories are received and acted on. There is no vulnerability scanning of the running estate and no external penetration test.
Infrastructure is defined in compose files and configuration in version control, so the running configuration is reproducible from the repository.
Personal and compliance data are deleted within 30 days of a request or termination, confirmed in writing, as committed in the DPA.
Advisory queries sent for inference are anonymised and not retained. No masking is applied elsewhere.
No data leakage prevention tooling is in place.
Daily dumps at 02:00 UTC with seven day retention. One region, and restores are not tested on a schedule.
No redundancy. One database on one host in one region. The frontend is redundant because Vercel is, which is not our doing.
Application and access logs are produced and retained on the host. There is no central log store and no tamper protection.
Health and error monitoring exist. There is no security monitoring or alerting on anomalous access.
Hosts synchronise time through the operating system's NTP, so log timestamps are comparable.
Privileged utilities are available to the one operator on the host. Their use is not restricted or logged separately.
The API image bakes its code, so what runs is what was built and deploying is a rebuild rather than an in place change.
Only 80 and 443 are exposed. Database, cache and API listen on the internal Docker network and are unreachable from outside.
All external traffic is TLS terminated at Caddy with certificates issued and renewed automatically, plus HSTS with preload.
Application services sit on an internal network with no public route; only the reverse proxy bridges the two.
No corporate network or user browsing to filter.
TLS in transit, encrypted volumes at rest, passwords hashed, API keys and entitlement tokens generated from a cryptographic random source.
Changes go through version control, typechecking and a test gate before deploy. There is no documented secure development lifecycle.
Authentication, authorisation and input handling are treated as requirements in design. They are not captured as written security requirements per change.
Least exposure by default: internal networks, no public database, single use tokens, ownership checks on every artefact a buyer can reach.
Parameterised queries throughout and user text never reaches a query language. There is no coding standard document and no static analysis in the pipeline.
A continuous integration gate runs typecheck and a published numbers check on every change, and functional verification is run against production after deploy. There is no security specific testing.
No development is outsourced.
Development is local and production is remote, so they are separated. There is no staging environment between them.
Every change is a commit with its reasoning, deployed by an automated path that refuses to run on a dirty tree and fast forwards only.
Test data is synthetic. No customer data is copied into development.
No audit testing on operational systems has been performed, since no audit has been commissioned.
The control list is the ISO 27001:2022 Annex A set as this platform holds it. You can pull the same 93 controls yourself from the free framework tools and check that nothing was quietly left out:
curl -sG https://api.theartofservice.com/api/agent/frameworks/ISO%2027001:2022/controls
The verdicts are ours, and they are a self assessment. Nobody independent has checked them, which is itself one of the controls we record as not met (5.35). Corrections to support@theartofservice.com. Back to the security page.