Are you SOC 2 or ISO 27001 certified?

Maleus is SOC 2-ready and ISO 27001-compatible: the controls are built and aligned to both. We walk your team through the details in a working session.

Which privacy and regulatory frameworks do you support?

We map our controls to the regime that applies to you: GDPR, CCPA, or PDPL for privacy, NIS2 and DORA for security and resilience, the EU AI Act for AI, and sector frameworks like HIPAA on request. The DPA and documentation are settled in contracting.

Where is our data stored, and in which region?

The delivered app and its data run where you choose: your own cloud, a region you pick, or on-premise. The build runs in Maleus's managed cloud; your production data isn't pulled into it.

Do you train on our code or data?

By default the build has no access to your database, so your data isn't sent to a model. Read-only is opt-in, and data-handling and model-provider terms are settled with your team in contracting.

Can you sign a DPA and provide a sub-processor list?

We settle the DPA, sub-processor list, and data-handling terms directly with your procurement and legal teams in contracting.

Do we own the code, and can we audit it?

Yes. The code is yours in your own Git, and you get full access to the complete build-session history, open to your own engineers.

Compliance

Your compliance file, already started.

A large-account review is a regulatory gauntlet, privacy, security, and AI rules, each wanting evidence and contracts, and the frameworks differ by region. Maleus comes with the posture built in: SOC 2-ready and ISO 27001-compatible, data protection answered by the architecture, and the contractual layer settled with your team.

Security & legal questionnaire

Where does our data go?answered

Do we own the generated code?answered

Can we audit how it was built?answered

Where will the app run?answered

Can you sign a DPA?with your team

We go through your questionnaire line by line.

The problem

A large-account review is a regulatory gauntlet

Security is only the first gate. Legal, privacy, and procurement bring their own, and the regulations behind them are stacking.

Regulations are stacking.

Privacy, security, and AI rules stack on the same vendor, and they differ by region: GDPR, CCPA, PDPL, plus NIS2, DORA, and the AI Act.

Proof, not promises.

A review runs on documents: certifications, a Data Processing Agreement, a sub-processor list, and an audit trail it can actually inspect.

Vendors are in scope.

Third-party risk is scrutinised hard, and the penalties behind these rules are steep, so the bar a vendor has to clear is high.

Most tools that generate software can't furnish that file. Maleus is built to.

Compliance posture

The posture your review checks, built in

The transverse standards your review can rely on up top, then the same controls mapped to whatever regional regime applies, across the US, the EU, and the Middle East.

Critical, cross-border

SOC 2How we run platform security: isolated build environments, controlled access, allowlisted egress, and full logging, mapped to its Trust Services Criteria.

ISO 27001The management system around it: risk assessment, security policies, and continual review that keep those controls governed, aligned to the standard.

ISO 27701How we handle personal data: records of processing, data-subject rights, and sub-processor control, built around GDPR and aligned to the standard.

ISO 42001How we govern the AI itself: agents sandboxed, no data access by default, every step human-reviewed and kept on an auditable record.

Mapped to your review

PrivacyGDPR, CCPA / CPRA, PDPL

Security & resilienceNIS2, DORA

AIEU AI Act

Sector & regionHIPAA, HDS, RGAA, on request

Framework-agnostic controls: we map them to your review's frameworks, not the other way around.

Your data, protected

Data protection, answered by design

Where your data lives, and what reaches a model, are answered by the architecture, not just a clause.

Data residency

You choose the region and jurisdiction for the delivered app and its data: your own cloud, or on-premise.

Personal data

Data handling is built around GDPR; the Data Processing Agreement is settled with your team in contracting.

Data and the model

By default the build has no database access, so your data isn't sent to a model; read-only is opt-in.

Subject requests

Because the app and its data are yours, on your infrastructure, you can serve access, deletion, and portability requests directly.

Detailed elsewhere, once:

How the build is isolated, with no access to your data Where the delivered app and its data can run

On the record

Every build is on the record, open to your engineers

A review wants the right to audit. Maleus gives you the thing that right exists to reach: the whole build, captured and open to your team.

The complete build session

Every step the agents took to build your app is captured: what was generated, and how. Nothing about how your software was built sits in a black box on our side.

Open to your engineers

You get full access to all the generated code and the entire build-session history, open to inspection by your own developers, not a summary we choose to share.

When your team can read the whole record, the right to audit stops being a clause to negotiate. It's something you already hold.

The checklist

What a review pulls on, and where Maleus stands

The questions a procurement, legal, privacy, and security review opens with, mapped to where Maleus is today.

What a review asks forWhere Maleus stands today

No production-database access during the buildNone by default, no read, no write. Read-only is opt-in, with the exposure stated.

An isolated, controlled build environmentEach agent runs isolated, in Maleus's managed cloud, never on local machines.

Controlled outbound networkA declarative allowlist: the app reaches only the domains you approve.

Full traceability and the right to auditFull access to all the code and the complete build-session history, open to your own engineers.

AI governance and oversightAgents run isolated and on the record, with controls aligned to ISO 42001 and the EU AI Act.

You own the deliverable, with no lock-inYour code, in your own Git. The delivered app runs multi-cloud or on-premise, with rollback.

Data residency and jurisdictionYou choose the region and jurisdiction for the delivered app and its data.

CertificationsSOC 2-ready and ISO 27001-compatible: controls built and aligned to both, walked through with your team.

Privacy and the regulatory regimeControls mapped to your review: GDPR, CCPA, PDPL, NIS2, DORA, the EU AI Act, and sector frameworks on request.

DPA, sub-processor list, IP terms, breach timingSettled with your procurement and legal teams in contracting.

Where a control is live, it's live. Where it's contractual, it's settled with your team.

Settled with your team

The contractual layer, settled with your team

The contractual artifacts a review needs, a Data Processing Agreement, the sub-processor list (including the model provider), DORA contractual clauses, IP terms, breach-notification timing, and EU AI Act documentation, are settled with your procurement and legal teams in contracting.

Bring your questionnaire; we work through it line by line, with your security, legal, and procurement teams.

Straight answers

The questions a review asks, answered

Bring your security and legal questionnaire.

Book a demo and we'll go through it line by line: the certifications, the data protection, the regulatory frameworks, and the contractual layer, with your security, legal, and procurement teams.

Built by the team behind a widely-used open-source backend and real-time data platform.