Security & Trust

DeGoyle is being developed for organisations that need clearer governance workflows, evidence management and regulatory readiness. Security, privacy and trust are core to how we are building the product and how we handle pilot discovery.

This page summarises DeGoyle's current public-website security posture, pilot discovery data handling, planned platform direction and trust commitments.

1. Executive summary for procurement and security teams

2. Current status

DeGoyle is currently in pre-launch / pilot discovery stage, with a September 2026 target for the first platform release. This target is indicative and may change as product, security, customer and regulatory requirements develop.

At this stage:

• The public website, degoyle.com, is used for information and pilot discovery enquiries.
• The pilot discovery form is intended to collect business contact and qualification information only.
• The public website does not require upload of customer evidence, internal policies, credentials, vulnerability data, incident reports, network diagrams or regulated operational data.
• Any future pilot involving customer data will be subject to separate written terms, security review, data protection terms and agreed data handling rules before access is granted.
• DeGoyle will not request unnecessary sensitive data through the public website.

3. Data requested during pilot discovery

For pilot discovery, DeGoyle may collect:

• Name.
• Organisation.
• Work email.
• Role or job title.
• Sector or organisation type.
• High-level governance, regulatory-readiness or operational context.
• Communication history relating to the enquiry.

Prospective pilot participants should not submit confidential security documentation, incident reports, vulnerability data, credentials, network diagrams, personal data sets, regulated operational data or other sensitive information through the public contact form.

4. Current website infrastructure

These providers process data as part of operating the website and handling pilot discovery enquiries. Provider security certifications and attestations apply to the provider environments and controls described in their own documentation; they do not independently certify DeGoyle.

5. Current website security controls

Current website controls include:

• HTTPS/TLS for website traffic, with HTTP Strict Transport Security (HSTS).
• HTTP security response headers: Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy.
• Managed hosting and deployment through Render.
• Database storage through Neon for pilot discovery enquiries.
• Access limited to authorised DeGoyle personnel.
• Rate limiting and abuse-prevention measures on form submissions.
• Client-side and server-side input validation on all public forms.
• Timing-safe credential verification for protected areas where applicable.
• Separation between public website enquiry data and any future customer platform data.
• Cookie/analytics consent controls for optional analytics.

These controls are appropriate for a pre-launch website and pilot discovery process. They are not a substitute for a full customer platform security programme, which will require separate documentation and controls before processing customer evidence or operational data.

6. Security principles for the DeGoyle platform

The DeGoyle platform is being designed around the following principles:

• Data minimisation — collect only what is needed for a defined purpose.
• Least privilege — grant access only where required for a role or function.
• Secure-by-default configuration — avoid insecure defaults and unnecessary exposure.
• Encryption in transit — protect traffic using TLS.
• Encryption at rest — use provider-supported encryption for stored data.
• Logical workspace separation — separate customer workspaces and access scopes.
• Role-based access control — apply user and workspace permissions.
• Auditability — log important administrative and user actions.
• Supplier transparency — document relevant providers and subprocessors.
• Retention and deletion discipline — define how data is retained and deleted.
• Human accountability — keep compliance and governance decisions under customer control.

7. Planned platform infrastructure

The DeGoyle platform is currently in development. The expected platform stack includes:

• Next.js application layer using TypeScript and React.
• PostgreSQL with pgvector for data storage and semantic search.
• Rust-based advisory engine for regulatory intelligence processing.
• Role-based access control for user and workspace management.
• Auth0 / Okta identity services via NextAuth or equivalent authentication architecture.
• Render.com or equivalent managed hosting for application deployment.

Render publishes documentation stating that its platform is compliant with SOC 2 Type 2 and ISO 27001. Auth0 / Okta publishes security, privacy, compliance and DPA resources. Those provider materials support vendor review but do not certify DeGoyle's own application, operating model or internal controls.

Before onboarding pilot customers into any platform workspace, DeGoyle should document the final architecture, hosting regions, identity model, access control model, logging approach, backup approach, subprocessor list and data flow.

8. Customer data during pilots

If a pilot requires customer data, DeGoyle will aim to define in writing before onboarding:

• The purpose of the pilot.
• The categories of customer data involved.
• Whether personal data, confidential data or regulated operational data is involved.
• Which users and DeGoyle personnel may access the data.
• Which subprocessors may process the data.
• Retention and deletion expectations.
• Security controls applicable to the pilot.
• Whether a Data Processing Agreement is required.
• Whether customer security review or approval is required before data transfer.

Pilot participants should not submit confidential, regulated or security-sensitive customer data unless a written pilot agreement and appropriate data protection arrangement are in place.

9. AI and automation

The DeGoyle platform is expected to use AI-assisted features for regulatory intelligence, workflow support and evidence-management assistance.

Where AI-assisted features are used, DeGoyle will aim to document:

• What data is processed by AI-assisted components.
• Which providers, if any, process that data.
• Whether data leaves the selected hosting region.
• Whether customer data is used to train external or public models.
• What human review, user control and governance safeguards apply.
• Any limitations, disclaimers or validation requirements for AI-generated outputs.

Unless expressly agreed in writing, pilot customer data will not be used to train external or public AI models.

AI-assisted outputs should be treated as workflow support, not as legal, regulatory, audit, assurance or professional advice.

10. Compliance position

DeGoyle helps organisations manage governance workflows and evidence for cybersecurity and resilience frameworks, including NIS2 and the CER Directive.

DeGoyle does not provide:

• Legal advice.
• Regulatory advice.
• Audit opinions.
• Assurance reports.
• Certifications.
• Formal compliance determinations.
• Cybersecurity consulting opinions unless separately agreed in writing.

Customers remain responsible for their own compliance decisions and for seeking independent professional advice.

11. Certifications and assurance

At this stage, DeGoyle does not claim to hold SOC 2, ISO 27001 or other independent certification for its own organisation or application.

Some infrastructure providers used or considered by DeGoyle publish their own security certifications, audit reports, DPAs and compliance documentation. Those materials are useful for vendor risk review, but they do not replace DeGoyle's own controls or any future DeGoyle assurance programme.

As DeGoyle develops, we expect to evaluate an appropriate assurance roadmap, which may include:

• Formal internal security policies.
• Access control and change management procedures.
• Supplier risk management.
• Vulnerability management.
• Incident response procedures.
• Secure development practices.
• External penetration testing.
• SOC 2 Type II readiness or equivalent assurance.
• ISO 27001 readiness or equivalent information security management review.

No certification timeline is guaranteed unless separately stated in a signed customer agreement.

12. Vulnerability disclosure

If you believe you have discovered a security vulnerability or issue involving DeGoyle, contact:

support@degoyle.com

Please include enough detail for us to understand, reproduce and investigate the issue.

Unless a separate vulnerability disclosure policy is published, do not conduct:

• Denial-of-service testing.
• Social engineering.
• Physical attacks.
• Credential stuffing or password attacks.
• Testing against third-party providers.
• Accessing, modifying, deleting or exfiltrating data that does not belong to you.
• Intrusive testing that could degrade service or affect other users.

We aim to acknowledge responsible reports promptly and address confirmed issues in a risk-based manner.

13. Planned trust improvements

As DeGoyle develops toward pilot onboarding and platform launch, we expect to expand trust documentation with:

• Full subprocessor list.
• Data Processing Agreement for pilot customers where required.
• Platform security overview.
• Pilot agreement and acceptable use terms.
• Vulnerability disclosure policy.
• Access control and authentication overview.
• Data retention and deletion policy.
• AI transparency statement.
• Incident response overview.
• Secure development lifecycle summary.
• External security testing roadmap.
• Certification or assurance roadmap.

14. Contact

For security, privacy or trust questions, contact:

support@degoyle.com
Dublin, Ireland