Security and Trust
An honest account of our current security posture, what we store, how provenance integrity works, and what rights you hold over your data. No certifications are claimed that we do not hold.
Legal identity
Abraham of London is operated by Alomarada Ltd, a UK registered company. Company no. 11549053.
Verify on Companies HouseSecurity assurance status
Current
- Provider posture disclosed
- Cloudflare DNS boundary stated
- Sub-processors named
- Data handling stated
- Provenance boundary stated
Not yet completed
- SOC 2
- ISO 27001
- Independent penetration test
Security assurance readiness
Independent SOC 2, ISO 27001 certification, and external penetration testing are not yet complete. The current assurance posture is documented through legal identity, infrastructure disclosure, sub-processor visibility, pilot data boundaries, incident-response posture, and provenance / auditability controls.
Operational Governance
Abraham of London operates administrative, publishing, and support workflows through a governed command environment. Access to sensitive operations is role-gated: different authority levels unlock different capabilities, and the most consequential controls — including platform-level lock and unlock — require the highest authority tier.
Report lineage is recorded end-to-end. Every material event — creation, viewing, export, update, escalation, revocation — is written to an append-only ledger. Reports can be revoked by authorised operators; revocation is logged with actor, timestamp, and authority. Cohort privacy is enforced at both write time and read time: any subgroup that falls below the minimum respondent threshold is suppressed before it reaches any output surface.
External platform integrations, including LinkedIn, are treated as controlled publishing channels. Permissions are scoped to the operational purpose, credentials are kept server-side, and publishing activity is limited to authorised operators. Internal coordination channels support incident response, deployment review, and operator accountability. They do not replace governance; they support it.
What this means in practice
Governed decision infrastructure
A structured way to record, test, and follow through on important decisions.
Evidence posture
Whether the decision is supported by facts or mainly by assertion.
Consequence path
What happens if the decision is delayed, wrong, or not acted on.
Institutional memory
A durable record of what was decided, why, and what changed later.
Provenance
The accountable chain showing what was reviewed, constrained, delivered, and recorded.
Security posture
DNS / registrar
Hosting
TLS boundary
Cloudflare boundary
Authentication
MFA / SSO
Administrative access
Database
Secrets management
Dependency scanning
Rate limiting
Error handling
Data handling
What we store
What we do not store
Data location
Retention
Third-party access
Analytics and telemetry
Encryption at rest
Backups
Provenance boundary
The provenance system computes and stores SHA-256 hashes of canonical case records. This creates structural tamper-evidence — if a record changes after sealing, its hash no longer matches. Verification is performed on demand; results are not cached.
Terms used here
- Sealing
- Finalising a record and computing its hash, closing it against undetected modification.
- Tamper-evidence
- If any field changes after sealing, the hash no longer matches — changes become detectable.
- Hash
- A unique fingerprint of a record's content. Any change produces a different fingerprint.
- Anchoring
- Publishing the hash to an external immutable log so verification does not depend solely on internal records.
Internal chain anchoring
LiveHash computed and stored for supported governed records at time of sealing.
External WORM anchoring
Architected, not liveArchitecture designed. Not yet connected to an external immutable log. No blockchain or public ledger claims are made.
Client-facing hash verification
LiveAuthenticated users can verify supported records via /api/provenance/verify-case.
Public demo verification
LiveAnyone can verify the canonical demo record at /provenance/demo.
Certifications and compliance
We state exactly what we hold and what we do not. No certifications are implied beyond what is listed here.
Company / platform certifications
SOC 2 Type I
PlannedNot yet held. Planned as part of enterprise readiness programme.
SOC 2 Type II
Not yetNot yet held. Follows SOC 2 Type I. No timeline committed publicly.
ISO/IEC 27001 organisational certification
Not yetNot yet held.
Independent security audit
PlannedPlanned before enterprise GA. Specific firm not yet engaged.
GDPR compliance programme
In progressData rights fulfilment (deletion, export) implemented. DPA available on request for enterprise accounts.
CCPA compliance
In progressData rights implemented. Privacy policy covers CCPA requirements.
Founder assurance credentials
Abraham Adaramola holds an ISO/IEC 27001:2022 Lead Auditor credential and has formal training across consulting management, company direction, cybersecurity, business development, and MBA-level brand leadership.
These credentials support assurance literacy, audit awareness, and governance discipline. They should not be read as independent certification of Alomarada Ltd, Abraham of London, or the platform.
View founder profile on LinkedInISO/IEC 27001:2022 Lead Auditor
LiveAbraham Adaramola — Mastermind Assurance
Level 7 Diploma in Consulting Management
LiveChartered Management Institute, 2017
MBA, Brand Leadership
LiveUniversity of East Anglia, 2017
Cybersecurity training
LiveFormal cybersecurity training supporting assurance literacy.
Sub-processors
Cloudflare
Global network
Netlify
US/EU
Neon / PostgreSQL
EU
Upstash Redis
EU
Resend
US
Stripe
US/EU
Vercel Analytics / PostHog
EU
Uptime and status
Status page
Incident notification
Target uptime
Planned maintenance
Responsible disclosure
If you discover a security vulnerability, please report it privately. We commit to acknowledging receipt within 2 business days and communicating a remediation plan within 10 business days.
Report to
Scope
Out of scope
Bug bounty
Your rights
Only rights that are implemented are listed here.
Right to deletion
LiveYou may delete any governed case you own from Decision Centre. Deletion is permanent after a 30-day grace period. API: DELETE /api/cases/[caseId].
Right to export
LiveYou may export all your personal data in JSON format from Decision Centre or account settings. Export excludes raw internal governance fields. API: GET /api/user/data-export.
Right to rectification
LiveYou can correct case metadata (case name, status) through Decision Centre. Assessment results themselves are immutable — their integrity depends on immutability.
Right to restriction
LiveThe system does not use personal data for automated decision-making beyond the explicit governance features you opt into. No profiling for advertising or third-party scoring.
Right to portability
In progressCovered by the data export function. Machine-readable JSON. Structured export format under review.
To exercise any right or to request a Data Processing Agreement, contact support@abrahamoflondon.org.
Example
Decision submitted
“Should we delay a regional launch because operations cannot support the promised service level?”
System tests
- →
Evidence gap — is the service-level shortfall documented or asserted?
- →
Authority ambiguity — who owns the go or no-go, and have they been named?
- →
Cost of delay — what accrues each week the launch does not happen?
- →
Escalation condition — what event forces the decision, with or without action?
Governed output
Required move
Quantify the service-level gap before the launch date is revisited.
Named owner
Operations lead — accountable for the evidence report.
Checkpoint
Review in 5 days. If evidence is not ready, delay is the governed finding.
Consequence if ignored
Launch proceeds on assertion, not evidence. Governance gap is recorded.
Memory carried forward
The condition, the required move, and the checkpoint are written to the decision record.
Contact for security review
Enterprise and procurement enquiries requiring a security review pack, DPA, or detailed architecture briefing should use the link below.
Related
Abraham of London provides governed decision instruments and structured advisory frameworks. Nothing on this page constitutes legal, financial, investment, tax, medical, immigration, accounting, or other regulated professional advice. Access fees, where applicable, are charged for methodology access, software-enabled records, structured outputs, and session facilitation, not for guaranteed outcomes.