Trust Center.
The answers your security and procurement review needs, stated exactly. Full policies sit one click deeper on this page.
- Information security
- ISMS aligned with ISO/IEC 27001:2022. Not yet certified; certification targeted November 2027.
- Quality
- QMS aligned with ISO 9001. Not certified.
- Your data
- Stays in your cloud and region. Never used to train outside models.
- Your code
- In your repositories from day one. You own the IP.
- AI in delivery
- A named engineer signs off every release.
- Security pack
- Shared under NDA.
Where we stand today, without the logo.
ISMS aligned with ISO/IEC 27001:2022
Certification by an accredited body is targeted for November 2027. Until then, we are not yet certified. Our CTO is accountable.
QMS aligned with ISO 9001
Every step has a written definition of done, and nothing ships without a named sign-off.
Our ISMS and quality statement in full
SoftSora operates an information security management system (ISMS) aligned with ISO/IEC 27001:2022. We are not yet certified. We are working towards certification by an accredited certification body, with a target of November 2027. Customers and prospects can request our Statement of Applicability and certification roadmap under NDA. When a certificate is issued, we will publish the certificate number, scope and certification body so you can verify it independently.
Our quality management system is aligned with ISO 9001. We do not currently hold ISO 9001 certification.
Last updated: 4 October 2026
Frameworks we map to
- OWASP Top 10 for LLM Applications
- MITRE ATLAS
- NIST AI RMF
- ISO/IEC 42001
- EU AI Act
- IEC 62443
- GDPR
References we use to structure controls, reviews and evidence. Mapped to or informed by, not certifications.
Your data stays where you put it. Your code stays yours.
Your cloud, your region
We work inside your environment, encrypted, with named accounts. Data is returned or deleted at the end.
Agents build. Engineers own.
Approved tools only, no client data in public models, and a named sign-off on every release.
Your code, your IP
In your repositories from day one. You own the IP we deliver; we license only our generic accelerators.
Listed on request
The list of third parties SoftSora uses comes with the security pack.
Data handling and residency in full
- Residency. You choose the cloud provider and region. Options include EU hosting for Europe and UAE or Saudi cloud regions for the Gulf.
- Encryption. In transit and at rest.
- Access. Named people only, removed when the engagement ends.
- Agreements. A data processing agreement on request, with GDPR Standard Contractual Clauses for Europe.
- End of contract. You receive the code, documentation and runbooks, and we return or delete your data, as you choose.
AI policy in full
We build with Anthropic models and on AWS, including Amazon Bedrock.
- Approved tools. Coding agents and models come from an approved list and are used under terms that keep your inputs out of model training.
- Client data. Your code and data never go into consumer or public AI tools. Where a model must see your data, it runs in your cloud account or under terms you approve.
- Human review. Agents write and test. A named person reviews and merges every pull request, and a named engineer signs off every release.
- Records. Each change leaves a trail in your repositories: the pull request, its reviewer and the tests that ran.
Sub-processor categories
The systems we build run in your own cloud account, under your contract with that provider. Named providers are available on request.
| Category | Purpose | Provider and location |
|---|---|---|
| Project tracking and documentation | Plans, tickets, decision logs and progress reports | List published on request while being finalised |
| Messaging and video meetings | Day-to-day contact between your team and ours | List published on request while being finalised |
| AI models used in delivery | Coding agents and model access, with no training on your data | List published on request while being finalised |
| Email and file sharing | Proposals, contracts and the documents you send us | List published on request while being finalised |
What this site collects, and how to report an issue.
Only what you send us, only to answer you
We work under the EU GDPR, Japan's APPI and Sri Lanka's PDPA. These are laws we follow, not certifications we hold.
Found a security issue? Tell us privately.
Report it to enterprise@softsora.com with "Security" in the subject line.
Privacy notice summary
- What we collect. Your name, work email, company, region and what you tell us about the outcome you want. Japanese forms also ask for an optional phone number.
- Purpose. To reply to your enquiry, arrange an NDA or a proposal, and send the documents you ask for.
- Retention. Only as long as we need it to answer you and to manage any engagement that follows.
- Your rights. You can ask to see, correct or delete your data, as the law that applies to you allows.
- Where. Our headquarters and engineering team are in Colombo, Sri Lanka, so your enquiry may be handled there.
- Contact. Write to enterprise@softsora.com with "Privacy" in the subject line.
Read the full privacy policy and cookie policy for this site.
Vulnerability disclosure policy
This covers softsora.com and systems SoftSora operates. A system we built for a client belongs to that client: report it to them directly, or to us and we will pass it on with your consent.
What to include: the system affected, steps to reproduce, the likely impact and how to reach you.
What we commit to: we acknowledge your report, keep you informed until it is fixed, and keep your details confidential.
What we ask of you: do not touch data that is not yours or degrade our services, and give us reasonable time to fix the issue before any public disclosure.
Recognition, stated exactly.
Coverage of our work and the profiles that list us, each linked to its source. None of them is a certification or an endorsement.
Verified profiles & recognition
IPD · Import Promotion Desk (Germany)
Evaluated provider of digital services & products
Germany's BMZ-backed Import Promotion Desk lists SoftSora as an AI-driven software and digital company from Sri Lanka, operating across Japan, the US and Europe.
UNIDO ITPO Tokyo
Sri Lankan company profile
A UNIDO ITPO Tokyo profile listing SoftSora (founded 2023) in the context of business-matching between Sri Lankan and Japanese partners.
Clutch
SoftSora reviews & verified ratings
Independent B2B review platform profile, with a 5.0 rating and verified client reviews of our software and digital work.
Press coverage
Daily FT
April 2025
Sri Lanka ICT Networking Session, B2B Forum in Tokyo
Reports on the ICT networking session and B2B forum during Japan IT Week Spring 2025, naming SoftSora among ten export-ready Sri Lankan firms selected from over 85 applicants.
Daily FT
April 2025
Lankan ICT companies to showcase innovation at Japan IT Week
Coverage of the EDB and JICA initiative, noting SoftSora's two-plus years collaborating with Japanese companies.
Sri Lanka Export Development Board
April 2025
Sri Lankan ICT Companies to Showcase Innovation at Japan IT Week 2025
Official EDB announcement of the ten companies exhibiting under the Sri Lanka Pavilion at Tokyo Big Sight, facilitated by JICA.
The details, in full
In April 2025, SoftSora exhibited at Japan IT Week Spring 2025 (organised by RX Japan) at Tokyo Big Sight, as one of ten Sri Lankan ICT companies in the Sri Lanka Pavilion. The pavilion was organised by the Sri Lanka Export Development Board (EDB) in collaboration with the Japan International Cooperation Agency (JICA) and the Embassy of Sri Lanka in Japan, and JICA's announcement of 9 April 2025 lists SoftSora among the exhibitors it supported.
In April 2026 SoftSora took part in the IPD Selling Mission GER/SWE 2026 run by the Import Promotion Desk (IPD), an initiative funded by Germany's Federal Ministry for Economic Cooperation and Development (BMZ). The mission covered Hannover Messe, betahausX Berlin and the Nordic Growth Summit in Stockholm.
Does JICA certify SoftSora?
No. JICA does not certify companies like ours. In April 2025 we exhibited at Japan IT Week Spring 2025 in the Sri Lanka Pavilion with JICA's exhibition support, and JICA's own announcement lists SoftSora among the exhibitors.
Everything your security review asks for, in one pack.
Shared under NDA. If your organisation uses its own questionnaire, we complete that too, in English or Japanese.
On the contact form, tick "Send me an NDA first" and mention the security pack.
- 01Statement of ApplicabilityThe ISO/IEC 27001:2022 controls we apply, and why.
- 02Certification roadmapWith certification targeted for November 2027.
- 03PoliciesOur information security policy and AI use policy.
- 04Data processing agreement templateWith GDPR Standard Contractual Clauses for Europe.
- 05The current sub-processor listWith purpose, provider and location.
- 06Penetration test summarySummary of an independent test, added when available.
- 07InsuranceInsurance cover and certificate.
Your security review, answered by engineers.
We complete your security questionnaire, in English or Japanese.
If you prefer, we sign an NDA before we ask for any details.