Compliance
Certifications & Compliance
We are transparent about where we are today, what we are working towards, and when we expect to get there.
Current posture
| Framework | Status | Notes |
|---|---|---|
| GDPR (EU 2016/679) | Operational | Operational compliance |
| NIS2 (EU 2022/2555) | Aligned | Aligned to Art. 21(2) measures; not directly in scope as SaaS vendor |
| ISO/IEC 27001:2022 | In progress | Gap analysis complete; certification work in progress |
| SOC 2 Type II | Planned | Reassessed once ISO 27001 achieved |
| PCI DSS | Operational | SAQ-A applicable via Stripe; no card data stored by Giesen |
| EU-US Data Privacy Framework | Aligned | Applied indirectly via DPF-certified US sub-processors + SCCs |
Roadmap
All target dates are subject to change.
- Q2 2026 ISO/IEC 27001:2022 gap analysisDone
- Q3 2026 ISMS policy set documentedIn progress
- Q3 2026 Trust Center page publishedIn progress
- Q3 2026 Public security.txtDone
- Q4 2026 First external penetration testPlanned
- Q4 2026 Incident response tabletop exercisePlanned
- Q4 2026 Backup restore drillPlanned
- TBD ISO 27001 Stage 1 auditPlanned
- TBD ISO 27001 Stage 2 auditPlanned
- TBD ISO 27001 certificationPlanned
Need evidence for procurement?
Under mutual NDA we share our internal gap analysis, sub-processor DPAs, and (once produced) penetration test reports.