<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width,initial-scale=1">
  <title>Trust &amp; Compliance Posture - Roam</title>
  <meta name="description" content="Roam's trust posture: current certification status, DPA, sub-processors, security contact, vulnerability disclosure, and data-flow diagram.">
  <link rel="canonical" href="https://roam-code.com/trust">
  <link rel="icon" type="image/svg+xml" href="/favicon.svg">
  <meta name="theme-color" content="#0049b7">
  <meta name="apple-mobile-web-app-title" content="Roam">
  <link rel="apple-touch-icon" href="/favicon.svg">
  <link rel="manifest" href="/manifest.webmanifest">
  <link rel="preload" href="/fonts/space-grotesk-variable.woff2" as="font" type="font/woff2" crossorigin>
  <link rel="preconnect" href="//github.com" crossorigin>
  <link rel="preconnect" href="//pypi.org" crossorigin>
  <link rel="preload" href="./landing.css" as="style">
  <link rel="stylesheet" href="./landing.css">
  <meta name="robots" content="index,follow">

  <meta property="og:title" content="Trust &amp; Compliance Posture — Roam">
  <meta property="og:description" content="Honest status on SOC 2 Type II, ISO/IEC 42001, EU AI Act Article 12, and NIST AI RMF — plus the DPA, sub-processor list, security contact, vulnerability disclosure, and data-flow diagram. Evidence support, not certification.">
  <meta property="og:type" content="website">
  <meta property="og:url" content="https://roam-code.com/trust">
  <meta property="og:image" content="https://roam-code.com/og.png">
  <meta name="twitter:card" content="summary_large_image">
  <meta name="twitter:title" content="Trust &amp; Compliance Posture — Roam">
  <meta name="twitter:description" content="Honest posture on SOC 2, ISO 42001, EU AI Act, and NIST AI RMF — with the artifacts procurement reviewers want and no current certification claim.">
  <meta name="twitter:image" content="https://roam-code.com/og.png">

  <script type="application/ld+json">
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {"@type": "ListItem", "position": 1, "name": "Home", "item": "https://roam-code.com/"},
      {"@type": "ListItem", "position": 2, "name": "Trust", "item": "https://roam-code.com/trust"}
    ]
  }
  </script>
</head>
<body>

  <a class="skip-link" href="#main">Skip to content</a>

  <nav class="site-nav" aria-label="Main navigation">
    <div class="nav-inner">
      <a href="/" class="site-logo">roam<span class="logo-dot">.</span></a>
      <input type="checkbox" id="nav-toggle" class="nav-toggle-checkbox" aria-label="Toggle navigation menu">
      <label for="nav-toggle" class="nav-toggle-label">
        <span class="nav-burger" aria-hidden="true"></span>
        <span class="visually-hidden">Menu</span>
      </label>
      <ul class="nav-links">
        <li><a href="/">Home</a></li>
        <li><a href="/pricing">Pricing</a></li>
        <li><a href="/compare">Compare</a></li>
        <li><a href="/setup">Setup</a></li>
        <li><a href="/docs/">Docs</a></li>
        <li><a href="https://github.com/Cranot/roam-code">GitHub</a></li>
      </ul>
    </div>
  </nav>

  <main id="main">

  <!-- ──────────────────────────────────────────────────────────
       Hero
       ────────────────────────────────────────────────────────── -->
  <header class="hero">
    <div class="hero-inner">
      <p class="eyebrow">Trust &amp; compliance posture</p>
      <h1 class="hero-headline">
        Honest status,<br>
        <strong>no certification theater.</strong>
      </h1>
      <p class="hero-subhead">
        Where Roam stands on SOC 2 Type II (target Q1 2027), ISO/IEC 42001
        (target Q3 2027), EU AI Act Article 12 record-keeping, and the
        NIST AI Risk Management Framework — plus the DPA,
        sub-processor list, security contact, vulnerability disclosure,
        and data-flow diagram we hand over today. Evidence support and
        control mapping. Not certification.
      </p>
      <div class="hero-ctas">
        <a class="btn-primary" href="https://github.com/Cranot/roam-code/blob/main/templates/legal/security-procurement-packet.md">Download procurement packet</a>
        <a class="btn-secondary" href="#today">Where we are today</a>
      </div>
      <p class="hero-trust-strip">
        Built in Athens · Made in the EU · Apache 2.0 CLI · 100% local by default (opt-in metrics-push is the only outbound surface) · No API key · No vendor cloud endpoint · Evidence hash-verifies offline · No analytics · No cookies
      </p>
    </div>
  </header>

  <!-- ──────────────────────────────────────────────────────────
       Where we are today — honest framework status
       ────────────────────────────────────────────────────────── -->
  <section class="whats-in" id="today">
    <div class="whats-in-inner">
      <h2>Where we are today</h2>
      <p class="lede">
        Four frameworks procurement teams ask about, with our actual
        status and roadmap. No current independent attestation against
        any of these; when that changes we will publish the auditor or
        certification-body name and the report excerpts directly on
        this page.
      </p>
      <div class="verbs-grid verbs-grid--3">
        <div class="verb-cell">
          <code>SOC 2 Type II — in design (target Q1 2027)</code>
          <span>
            Controls in design. Honest target window: Q1 2027 for the
            first Type II report. No current independent attestation; the
            window is planning guidance, not a commitment. We will publish
            the auditor name and report excerpts here when issued.
          </span>
        </div>
        <div class="verb-cell">
          <code>ISO/IEC 42001 — gap analysis (target Q3 2027)</code>
          <span>
            AI management system gap assessment in progress against the
            ISO/IEC 42001:2023 control set. Honest target window:
            Q3 2027 for certificate issue. No current certification; the
            window is planning guidance, not a commitment.
          </span>
        </div>
        <div class="verb-cell">
          <code>EU AI Act Article 12 — evidence layer shipped</code>
          <span>
            Roam's tamper-evident audit-trail and proof-bundle substrate
            generates the record-keeping evidence Article 12 requires for
            high-risk AI systems listed in Annex III. Whether your system
            falls under Article 12 is your DPO's and counsel's call;
            Roam supplies the evidence layer to support that
            determination.
          </span>
        </div>
        <div class="verb-cell">
          <code>NIST AI RMF — voluntary frame</code>
          <span>
            The NIST AI Risk Management Framework 1.0 (Jan 2023) is a
            voluntary framework. We map Roam's evidence outputs to the
            MAP / MEASURE / MANAGE / GOVERN categories so customers
            without a mandated regime can still anchor their AI-agent
            change-control program to a recognized reference.
          </span>
        </div>
      </div>
      <p class="how-it-works-foot" style="margin-top: 24px;">
        See the <a href="/governance#controls">governance page control
        mapping</a> for the row-by-row table tying each evidence type to
        the SOC 2, ISO 42001, NIST AI RMF, and EU AI Act Article 12
        clauses it supports.
      </p>
    </div>
  </section>

  <!-- ──────────────────────────────────────────────────────────
       Procurement artifacts — what we have right now
       ────────────────────────────────────────────────────────── -->
  <section class="how-it-works" id="artifacts">
    <div class="how-it-works-inner">
      <h2>What we have right now</h2>
      <p class="lede">
        Artifacts a procurement reviewer can collect today, before
        external attestations exist. All five are public on GitHub or
        this site; nothing is gated behind a sales conversation.
      </p>
      <ol class="flow">
        <li>
          <span class="flow-num">1</span>
          <strong>Data Processing Addendum (DPA).</strong>
          GDPR Article 28 processor agreement covering the
          customer-as-controller, Roam-as-processor relationship for PR
          Replay and planned Roam Review engagements. Lists processing
          categories, retention windows, sub-processor change notice, and
          audit rights. Published at
          <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md">templates/legal/dpa.md</a>;
          the PR Replay SOW that incorporates this DPA by reference is at
          <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/sow-pr-replay.md">templates/legal/sow-pr-replay.md</a>.
        </li>
        <li>
          <span class="flow-num">2</span>
          <strong>Sub-processor list.</strong>
          PR Replay v1 sub-processors are Stripe (payment processing) and
          GitHub (only when the buyer chooses GitHub repository access);
          the full list with purpose and EU/US location is in section 6
          of the <a href="/privacy#sub-processors">privacy policy</a>.
          The DPA requires 14-day advance notice for material additions.
          The CLI itself has no runtime sub-processors — it executes
          entirely on your machine.
        </li>
        <li>
          <span class="flow-num">3</span>
          <strong>Security contact.</strong>
          <code>security@roam-code.com</code> — OpenPGP key auto-published
          by Proton. Discoverable via the
          <a href="/.well-known/security.txt">security.txt</a> file at the
          standard well-known location. Acknowledgement within one
          business day.
        </li>
        <li>
          <span class="flow-num">4</span>
          <strong>Vulnerability disclosure policy.</strong>
          Full coordinated-disclosure policy on the
          <a href="/security">security page</a>: scope, safe-harbor terms,
          remediation SLAs (high within 30 days, medium within 90, low at
          next scheduled release), and a default 90-day public-disclosure
          window we extend on reporter request. Roam does not run a
          monetary bug-bounty program yet; until a paid program is
          announced, responsible reports receive public acknowledgement in
          the security page hall-of-fame plus, on request, a written
          reference confirming the report and remediation outcome.
        </li>
        <li>
          <span class="flow-num">5</span>
          <strong>Data-flow diagram.</strong>
          The CLI's data flow is short enough to inline: your source
          code is read from the local working tree, parsed and indexed
          into a local SQLite database under <code>.roam/</code>, and
          analyzed by local processes. <strong>100% local by default, no API key,
          no vendor cloud endpoint</strong> — no telemetry, no analytics,
          no model-training upload, and no inbound network listener. The
          one outbound carve-out is the opt-in <code>metrics-push</code>
          command, which emits Prometheus-format metrics to a
          user-configured pushgateway URL when (and only when) you
          explicitly invoke it; it is off by default and never auto-runs.
          The
          same local-only stance is contractually committed in
          <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md#6-security-measures">DPA §6</a>.
          Roam Review and Roam Cloud data flows are documented inside the
          <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/security-procurement-packet.md">procurement packet</a>.
        </li>
      </ol>
    </div>
  </section>

  <!-- ──────────────────────────────────────────────────────────
       Roam's evidence layer — what ships in the CLI today
       ────────────────────────────────────────────────────────── -->
  <section class="whats-in" id="evidence-layer">
    <div class="whats-in-inner">
      <h2>Roam's evidence layer</h2>
      <p class="lede">
        While the framework attestations are in flight, the free CLI
        already ships four evidence substrates auditors and reviewers can
        consume directly. None of them is a substitute for a SOC 2 or
        ISO 42001 report; they are the inputs an audit would draw from.
      </p>
      <div class="verbs-grid verbs-grid--3">
        <div class="verb-cell">
          <code>Tamper-evident audit trail</code>
          <span>
            CGA-signed event records covering every command an agent or
            human ran against the local repo. Forwards-compatible with
            cryptographic signature schemes; today the bundles are signed
            with in-toto v1 + cosign so reviewers can verify integrity
            without contacting us.
          </span>
        </div>
        <div class="verb-cell">
          <code>Proof bundles per PR</code>
          <span>
            <code>roam pr-bundle init / emit</code> packages the
            preflight, impact, critique, and test artifacts associated
            with a single change into one signed bundle. Reviewers see
            exactly what context the agent consumed before editing.
          </span>
        </div>
        <div class="verb-cell">
          <code>Mode enforcement</code>
          <span>
            Four cumulative action surfaces — <code>read_only</code>,
            <code>safe_edit</code>, <code>migration</code>,
            <code>autonomous_pr</code> — declared per run and enforced
            by the local control plane. Mode escalations are logged
            with timestamps and the lease record of the human approver.
          </span>
        </div>
        <div class="verb-cell">
          <code>Run ledger with HMAC chain</code>
          <span>
            Each <code>roam runs</code> session opens an event ledger
            with HMAC-chained entries. Tampering with any historical
            entry breaks the chain; <code>roam runs verify</code> reports
            the first divergent event so a reviewer can identify any
            post-hoc edits without trusting our infrastructure.
          </span>
        </div>
      </div>
      <p class="how-it-works-foot" style="margin-top: 24px;">
        For the full control-mapping table from these four substrates to
        SOC 2 CC8.1, ISO/IEC 42001 Annex A, NIST AI RMF, and EU AI Act
        Article 12, see the
        <a href="/governance">Agent Governance Evidence Pack</a> page.
      </p>
    </div>
  </section>

  <!-- ──────────────────────────────────────────────────────────
       Cross-links
       ────────────────────────────────────────────────────────── -->
  <section class="trust-strip" id="cross-links">
    <div class="trust-strip-inner">
      <div class="trust-cell">
        <strong>Security policy</strong>
        <span>
          Threat model, secure-coding posture, vulnerability disclosure
          terms, and PGP key locations live on the
          <a href="/security">security page</a>. That's the operational
          companion to this posture page.
        </span>
      </div>
      <div class="trust-cell">
        <strong>Agent governance pack</strong>
        <span>
          For the agent-governance-specific evidence pack — control
          mapping table, sample report, in-toto attestation format — see
          the <a href="/governance">governance page</a> (the AI-agent
          change-governance companion to this trust posture).
        </span>
      </div>
      <div class="trust-cell">
        <strong>Privacy policy</strong>
        <span>
          GDPR data-processing details, retention windows, lawful basis,
          and the current sub-processor list are on the
          <a href="/privacy">privacy page</a>.
        </span>
      </div>
      <div class="trust-cell">
        <strong>Procurement packet</strong>
        <span>
          A single bundle for vendor reviewers — DPA, NDA template,
          security-procurement packet, and master SOW — is published at
          <a href="https://github.com/Cranot/roam-code/tree/main/templates/legal">templates/legal/</a>.
          The direct packet file:
          <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/security-procurement-packet.md">security-procurement-packet.md</a>.
        </span>
      </div>
      <div class="trust-cell">
        <strong>Adjacent pages</strong>
        <span>
          The five-page evidence cluster:
          <a href="/audit">PR Replay audit</a> ·
          <a href="/governance">Governance</a> ·
          <a href="/pricing">Pricing</a> ·
          <a href="/docs/architecture">Architecture</a>.
        </span>
      </div>
    </div>
  </section>

  <!-- ──────────────────────────────────────────────────────────
       Disclaimer — explicit honest framing
       ────────────────────────────────────────────────────────── -->
  <section class="trust-strip" id="disclaimer">
    <div class="trust-strip-inner">
      <div class="trust-cell">
        <strong>Evidence support, not certification</strong>
        <span>
          This page is evidence support, not a certification claim. Roam
          Code provides evidence-export and control-mapping support for
          AI-agent change governance; it does not perform compliance
          attestation, and nothing here should be read as a statement of
          formal conformity against any framework. Consult qualified
          counsel and auditors for formal certification against SOC 2,
          ISO/IEC 42001, the EU AI Act, or any other regime.
        </span>
      </div>
      <div class="trust-cell">
        <strong>Article 12 framing</strong>
        <span>
          EU AI Act Article 12 (record-keeping) attaches to providers of
          high-risk AI systems listed in Annex III. Code-generation
          tooling is not itself in Annex III. If your <em>own product</em>
          is a high-risk AI system, Roam's tamper-evident ledger is
          useful evidence we collect for the Article 12 record-keeping
          expectation and the Article 14 human-oversight expectation;
          whether the obligations apply to your system is a call for
          your DPO and counsel.
        </span>
      </div>
      <div class="trust-cell">
        <strong>Timeline candor</strong>
        <span>
          Honest target windows: SOC 2 Type II Q1 2027,
          ISO/IEC 42001 Q3 2027. Planning guidance, not a commitment.
          Once external partners and dates are signed we will publish
          them here. Procurement reviewers who need a binding date:
          <a href="mailto:hello@roam-code.com?subject=Trust%20page%20timeline">hello@roam-code.com</a>.
          Payment-side commitments — refund window, invoicing cadence,
          Stripe-receipt vs legal tax-invoice — on the
          <a href="/refund">refund policy</a> and
          <a href="/audit#tiers">PR Replay audit</a>.
        </span>
      </div>
      <div class="trust-cell">
        <strong>EU-based, GDPR-native</strong>
        <span>
          EU provider, GDPR-native. Default PR Replay processing
          location is disclosed per
          <a href="https://github.com/Cranot/roam-code/blob/main/templates/legal/dpa.md#11-cross-border-transfers">DPA §11</a>.
          EU B2B buyers with a valid VAT-ID receive a separate
          locally-compliant tax invoice (reverse-charge VAT) within
          30 days of payment; the Stripe receipt is not the legal
          invoice in the provider's billing jurisdiction. See the
          <a href="/security">security policy</a> and the
          <a href="https://github.com/Cranot/roam-code/tree/main/templates/legal">procurement packet</a>
          for the DPA, no-training commitment, and supply-chain posture.
        </span>
      </div>
      <div class="trust-cell">
        <strong>Apache 2.0 open-source engine</strong>
        <span>
          The CLI that produces every evidence artifact is Apache 2.0 and
          public on
          <a href="https://github.com/Cranot/roam-code">GitHub</a> · the
          same package distributed on
          <a href="https://pypi.org/project/roam-code/">PyPI</a>. No
          proprietary binary in the analysis pipeline; reviewers can
          rebuild every bundle from source and verify the engine
          themselves. The
          <a href="https://github.com/Cranot/roam-code/blob/main/LICENSE">LICENSE</a>
          file in the repo carries the canonical Apache-2.0 text.
        </span>
      </div>
    </div>
  </section>

  <!-- ──────────────────────────────────────────────────────────
       CTA
       ────────────────────────────────────────────────────────── -->
  <section class="page-cta-strip">
    <div class="page-cta-inner">
      <p>
        Need a question answered for an in-flight procurement review, or
        a redacted DPA reviewed against your standard? Email
        <a href="mailto:hello@roam-code.com?subject=Trust%20page%20procurement%20question">hello@roam-code.com</a>
        — acknowledgement within one business day.
      </p>
    </div>
  </section>

  </main>

  <footer>
    <div class="footer-inner">
      <div class="footer-col">
        <strong>Roam</strong>
        <span>The local codebase intelligence layer for AI agents and the teams that run them.</span>
        <span class="footer-meta">Built in Athens. Made in the EU.</span>
      </div>
      <div class="footer-col">
        <a href="https://github.com/Cranot/roam-code">GitHub</a>
        <a href="https://pypi.org/project/roam-code/">PyPI</a>
        <a href="/docs/">Docs</a>
      </div>
      <div class="footer-col">
        <a href="/setup">Setup</a>
        <a href="/about">About</a>
        <a href="/press">Press</a>
        <a href="/changelog">Changelog</a>
        <a href="/status">Status</a>
        <a href="/security">Security</a>
        <a href="/accessibility">Accessibility</a>
      </div>
      <div class="footer-col">
        <a href="/privacy">Privacy</a>
        <a href="/terms">Terms</a>
        <a href="/refund">Refund</a>
        <a href="/no-cookies">No cookies</a>
      </div>
      <div class="footer-col">
        <a href="mailto:hello@roam-code.com">hello@roam-code.com</a>
        <a href="mailto:security@roam-code.com">security@roam-code.com</a>
        <span class="footer-meta">No cookies. No tracking. No analytics.</span>
        <span class="footer-meta"><a href="https://github.com/Cranot/roam-code/tree/main/templates/distribution/landing-page">This page is open source</a></span>
      </div>
    </div>
  </footer>

</body>
</html>
