Compliance roadmap

Certifications + audits we are pursuing.

• Vietnam Personal Data Protection (Nghị định 13/2023)

  In progress

  DPO appointed, RoPA maintained, breach procedure in place.

  Target: 2026-07-01

• GDPR (EU) — Article 30 RoPA + SCCs

  In progress

  RoPA published, SCCs Module 2 + Module 3 in customer DPA, EU rep appointed via outsourced service.

  Target: 2026-06-01

• ISO/IEC 27001:2022

  Planned

  Information Security Management System certification. Targeting Stage 1 audit in Q3 2026.

  Target: 2026-09-30

• SOC 2 Type I

  Planned

  Trust Services Criteria: Security + Confidentiality. Initial audit window: Q4 2026.

  Target: 2026-12-31

• SOC 2 Type II (6-month observation window)

  Planned

  Continuous-operation report. Targeting H2 2027.

  Target: 2027-09-30

• Annual third-party penetration test

  In place

  Most recent: 2026-Q1 — full-scope, no critical findings.

  Last reviewed: 2027-Q1