Compliance and Security
Our information security, privacy and responsible-AI governance programme, and how to request supporting evidence.
1. Information security, privacy and responsible AI governance
Lurny brings information security, privacy management and AI governance together to support enterprise use of our platform. Our compliance programme covers ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001, alongside work towards SOC 2 Type II and vulnerability assessment and penetration testing every three months.
2. Our compliance status
| Standard or activity | Current status |
|---|---|
| ISO/IEC 27001 | Compliant — information security management |
| ISO/IEC 27701 | Compliant — privacy information management |
| ISO/IEC 42001 | Compliant — artificial intelligence management |
| SOC 2 Type II | Policies under assessment as part of readiness work |
| VAPT | Conducted every three months |
3. Information security management
Lurny is compliant with ISO/IEC 27001. This standard provides a structured approach to managing information security risks and protecting the confidentiality, integrity and availability of information. It places security within an ongoing management process, with defined responsibilities and continual improvement.
4. Privacy information management
Lurny is compliant with ISO/IEC 27701. This standard addresses the management of privacy and the handling of personal information. It supports accountability for privacy responsibilities within an organisation’s management system. Our Privacy Policy explains how personal information is handled across the activities it covers.
5. Responsible AI governance
Lurny is compliant with ISO/IEC 42001. This standard establishes requirements for an AI management system, providing a structured approach to governing the development, provision and use of AI. For an AI-native platform, this brings attention to AI-related risks, responsibilities and oversight.
These statements describe Lurny’s compliance position. Applicable scope and supporting evidence should be reviewed for the service and deployment under consideration. A management-system compliance statement is not a guarantee that every AI output or customer use meets every regulatory requirement.
6. SOC 2 Type II readiness
We are having our policies assessed as part of our preparation for SOC 2 Type II. This work supports our readiness programme and the identification of areas requiring further attention.
Policy assessment is a preparatory step. A SOC 2 Type II report involves an independent examination of relevant controls and their operating effectiveness over a defined period. We will update this page when a report has been issued and its scope can be confirmed.
7. Security testing every three months
We conduct vulnerability assessment and penetration testing (VAPT) every three months. These assessments help identify security weaknesses within the systems and applications included in the testing scope.
For an enterprise review, request details of the latest assessment date, tested scope and available findings or remediation summary. The relevance of a test depends on the environment covered and its timing. Periodic testing does not guarantee that a service is free of vulnerabilities.
8. Supporting your enterprise review
Contact Lurny to discuss the evidence relevant to your security, privacy and procurement assessment. Depending on availability, scope and confidentiality restrictions, this may include compliance documentation, security policies, architecture and deployment information, or a VAPT summary.
Sensitive materials may require a non-disclosure agreement and approval before disclosure. The information provided for review should identify the services, environments and period it covers. Customer-specific security, hosting and data processing commitments are set out in the applicable agreement.