Trust & compliance posture

Honest status,
no certification theater.

Where Roam stands on SOC 2 Type II (target Q1 2027), ISO/IEC 42001 (target Q3 2027), EU AI Act Article 12 record-keeping, and the NIST AI Risk Management Framework — plus the DPA, sub-processor list, security contact, vulnerability disclosure, and data-flow diagram we hand over today. Evidence support and control mapping. Not certification.

Download procurement packet Where we are today

Built in Athens · Made in the EU · Apache 2.0 CLI · 100% local by default (opt-in metrics-push is the only outbound surface) · No API key · No vendor cloud endpoint · Evidence hash-verifies offline · No analytics · No cookies

Where we are today

Four frameworks procurement teams ask about, with our actual status and roadmap. No current independent attestation against any of these; when that changes we will publish the auditor or certification-body name and the report excerpts directly on this page.

SOC 2 Type II — in design (target Q1 2027) Controls in design. Honest target window: Q1 2027 for the first Type II report. No current independent attestation; the window is planning guidance, not a commitment. We will publish the auditor name and report excerpts here when issued.

ISO/IEC 42001 — gap analysis (target Q3 2027) AI management system gap assessment in progress against the ISO/IEC 42001:2023 control set. Honest target window: Q3 2027 for certificate issue. No current certification; the window is planning guidance, not a commitment.

EU AI Act Article 12 — evidence layer shipped Roam's tamper-evident audit-trail and proof-bundle substrate generates the record-keeping evidence Article 12 requires for high-risk AI systems listed in Annex III. Whether your system falls under Article 12 is your DPO's and counsel's call; Roam supplies the evidence layer to support that determination.

NIST AI RMF — voluntary frame The NIST AI Risk Management Framework 1.0 (Jan 2023) is a voluntary framework. We map Roam's evidence outputs to the MAP / MEASURE / MANAGE / GOVERN categories so customers without a mandated regime can still anchor their AI-agent change-control program to a recognized reference.

See the governance page control mapping for the row-by-row table tying each evidence type to the SOC 2, ISO 42001, NIST AI RMF, and EU AI Act Article 12 clauses it supports.

What we have right now

Artifacts a procurement reviewer can collect today, before external attestations exist. All five are public on GitHub or this site; nothing is gated behind a sales conversation.

1 Data Processing Addendum (DPA). GDPR Article 28 processor agreement covering the customer-as-controller, Roam-as-processor relationship for PR Replay and planned Roam Review engagements. Lists processing categories, retention windows, sub-processor change notice, and audit rights. Published at templates/legal/dpa.md; the PR Replay SOW that incorporates this DPA by reference is at templates/legal/sow-pr-replay.md.
2 Sub-processor list. PR Replay v1 sub-processors are Stripe (payment processing) and GitHub (only when the buyer chooses GitHub repository access); the full list with purpose and EU/US location is in section 6 of the privacy policy. The DPA requires 14-day advance notice for material additions. The CLI itself has no runtime sub-processors — it executes entirely on your machine.
3 Security contact. security@roam-code.com — OpenPGP key auto-published by Proton. Discoverable via the security.txt file at the standard well-known location. Acknowledgement within one business day.
4 Vulnerability disclosure policy. Full coordinated-disclosure policy on the security page: scope, safe-harbor terms, remediation SLAs (high within 30 days, medium within 90, low at next scheduled release), and a default 90-day public-disclosure window we extend on reporter request. A formal monetary bug-bounty program is [TBD: bug-bounty policy and reward tiers — pending live-payment setup]; until then we offer public acknowledgement in the security page hall-of-fame.
5 Data-flow diagram. The CLI's data flow is short enough to inline: your source code is read from the local working tree, parsed and indexed into a local SQLite database under .roam/, and analyzed by local processes. 100% local by default, no API key, no vendor cloud endpoint — no telemetry, no analytics, no model-training upload, and no inbound network listener. The one outbound carve-out is the opt-in metrics-push command, which emits Prometheus-format metrics to a user-configured pushgateway URL when (and only when) you explicitly invoke it; it is off by default and never auto-runs. The same local-only stance is contractually committed in DPA §6. Roam Review and Roam Cloud data flows are documented inside the procurement packet.

Roam's evidence layer

While the framework attestations are in flight, the free CLI already ships four evidence substrates auditors and reviewers can consume directly. None of them is a substitute for a SOC 2 or ISO 42001 report; they are the inputs an audit would draw from.

Tamper-evident audit trail CGA-signed event records covering every command an agent or human ran against the local repo. Forwards-compatible with cryptographic signature schemes; today the bundles are signed with in-toto v1 + cosign so reviewers can verify integrity without contacting us.

Proof bundles per PR roam pr-bundle init / emit packages the preflight, impact, critique, and test artifacts associated with a single change into one signed bundle. Reviewers see exactly what context the agent consumed before editing.

Mode enforcement Four cumulative action surfaces — read_only, safe_edit, migration, autonomous_pr — declared per run and enforced by the local control plane. Mode escalations are logged with timestamps and the lease record of the human approver.

Run ledger with HMAC chain Each roam runs session opens an event ledger with HMAC-chained entries. Tampering with any historical entry breaks the chain; roam runs verify reports the first divergent event so a reviewer can identify any post-hoc edits without trusting our infrastructure.

For the full control-mapping table from these four substrates to SOC 2 CC8.1, ISO/IEC 42001 Annex A, NIST AI RMF, and EU AI Act Article 12, see the Agent Governance Evidence Pack page.

Security policy Threat model, secure-coding posture, vulnerability disclosure terms, and PGP key locations live on the security page. That's the operational companion to this posture page.

Agent governance pack For the agent-governance-specific evidence pack — control mapping table, sample report, in-toto attestation format — see the governance page (the AI-agent change-governance companion to this trust posture).

Privacy policy GDPR data-processing details, retention windows, lawful basis, and the current sub-processor list are on the privacy page.

Procurement packet A single bundle for vendor reviewers — DPA, NDA template, security-procurement packet, and master SOW — is published at templates/legal/. The direct packet file: security-procurement-packet.md.

Adjacent pages The five-page evidence cluster: PR Replay audit · Governance · Pricing · Architecture.

Evidence support, not certification This page is evidence support, not a certification claim. Roam Code provides evidence-export and control-mapping support for AI-agent change governance; it does not perform compliance attestation, and nothing here should be read as a statement of formal conformity against any framework. Consult qualified counsel and auditors for formal certification against SOC 2, ISO/IEC 42001, the EU AI Act, or any other regime.

Article 12 framing EU AI Act Article 12 (record-keeping) attaches to providers of high-risk AI systems listed in Annex III. Code-generation tooling is not itself in Annex III. If your own product is a high-risk AI system, Roam's tamper-evident ledger is useful evidence we collect for the Article 12 record-keeping expectation and the Article 14 human-oversight expectation; whether the obligations apply to your system is a call for your DPO and counsel.

Timeline candor Honest target windows: SOC 2 Type II Q1 2027, ISO/IEC 42001 Q3 2027. Planning guidance, not a commitment. Once external partners and dates are signed we will publish them here. Procurement reviewers who need a binding date: hello@roam-code.com. Payment-side commitments — refund window, invoicing cadence, Stripe-receipt vs legal tax-invoice — on the refund policy and PR Replay audit.

EU-based, GDPR-native EU provider, GDPR-native. Default PR Replay processing location is disclosed per DPA §11. EU B2B buyers with a valid VAT-ID receive a separate locally-compliant tax invoice (reverse-charge VAT) within 30 days of payment; the Stripe receipt is not the legal invoice in the provider's billing jurisdiction. See the security policy and the procurement packet for the DPA, no-training commitment, and supply-chain posture.

Apache 2.0 open-source engine The CLI that produces every evidence artifact is Apache 2.0 and public on GitHub · the same package distributed on PyPI. No proprietary binary in the analysis pipeline; reviewers can rebuild every bundle from source and verify the engine themselves. The LICENSE file in the repo carries the canonical Apache-2.0 text.

Need a question answered for an in-flight procurement review, or a redacted DPA reviewed against your standard? Email hello@roam-code.com — acknowledgement within one business day.