> Security controls | Trust Center | Dating API: https://www.datingapi.io/trust/security [Trust Center](https://www.datingapi.io/trust) / Security controls # Every security control, with its status and date. Our technical and organisational measures (TOMs), as they stand today. 9 of 31 operate now; the rest finish by January 2027. Each area shows the ISO/IEC 27001:2022 Annex A controls and BSI C5 domains it answers. Reviewed 18 October 2026 - [Overview](https://www.datingapi.io/trust) - [Company](https://www.datingapi.io/trust/company) - [Security](https://www.datingapi.io/trust/security) - [Privacy](https://www.datingapi.io/trust/privacy) - [Sub-processors](https://www.datingapi.io/trust/subprocessors) - [Age checks](https://www.datingapi.io/trust/age-and-identity) - [Online safety](https://www.datingapi.io/trust/online-safety) - [AI](https://www.datingapi.io/trust/ai) - [Incidents](https://www.datingapi.io/trust/incidents) - [Laws](https://www.datingapi.io/trust/laws) Independent assurance ## Checked by people who don’t work for us. We are building our security programme to ISO/IEC 27001 and will be audited against it. Until the certificate is issued, we share the same evidence an auditor would see, under NDA. ### ISO/IEC 27001:2022 Security management system covering the platform, our people and our suppliers. Auditor booked by 15 December 2026; certification audits in the second quarter of 2027. In progress · target June 2027 ### Penetration testing An outside firm tests the platform, then every year and after major changes. Critical and high findings are fixed and retested, and partners get the summary. Planned · booked for Nov 2026 Our hosting providers’ own SOC 2 reports are listed on the [Sub-processors page](https://www.datingapi.io/trust/subprocessors). They cover their services, not ours. Security controls ## What protects the platform, and when. In place Operating today. To confirm We believe it is in place and are collecting the evidence. In progress Work has started and finishes by the date shown. Planned Work starts soon and finishes by the date shown. ### Governance ISO/IEC 27001 Annex A A.5.1, A.5.2, A.5.4 · BSI C5 OIS, SP - Information security management system built to ISO/IEC 27001:2022 In progress · Jan 2027 - Named security and privacy owner In place - Data protection officer appointed In progress · Oct 2026 - Risk register, reviewed by management every quarter In progress · Oct 2026 - Security policy set approved by management In progress · Oct to Dec 2026 ### Access ISO/IEC 27001 Annex A A.5.15, A.5.18, A.6.5, A.8.2, A.8.5 · BSI C5 IDM - Multi-factor sign-in on every staff, admin and cloud account In place - Least privilege by role, no shared accounts In progress · Oct 2026 - Leavers removed from every system on their last day In progress · Oct 2026 - Access to partner production data limited to named staff and reviewed every quarter Planned · Jan 2027 ### Encryption ISO/IEC 27001 Annex A A.8.24 · BSI C5 CRY - TLS 1.2 or higher for all external traffic In place - Encryption at rest (AES-256) for databases, storage and backups In place - Member passwords stored only as salted bcrypt hashes To confirm · Oct 2026 - Secrets in a managed store, never in code, with key rotation In place ### Data separation ISO/IEC 27001 Annex A A.8.20, A.8.31, A.8.33 · BSI C5 OPS, COS - A separate database for each partner To confirm · Oct 2026 - Development, staging and production kept apart; no member data in testing In progress · Nov 2026 - No public database endpoints; admin only through signed-in, logged routes In progress · Nov 2026 ### Monitoring ISO/IEC 27001 Annex A A.8.15, A.8.16 · BSI C5 OPS, SIM - Fraud and abuse monitoring of member behaviour In place - Every staff view of partner member data logged In place - Central logs of sign-ins, admin actions and data access, kept at least 12 months In progress · Nov 2026 - Security alerts with on-call response 24 hours a day In progress · Nov 2026 ### Building and fixing ISO/IEC 27001 Annex A A.8.4, A.8.8, A.8.25, A.8.28, A.8.32 · BSI C5 DEV, OPS - Peer code review and a protected main branch In progress · Nov 2026 - Dependency and secret scanning on every build In progress · Nov 2026 - Fixes within 7 days (critical), 30 days (high), 90 days (medium) In progress · Nov 2026 - Public route for reporting vulnerabilities (security.txt) In place ### Resilience ISO/IEC 27001 Annex A A.5.29, A.5.30, A.8.13 · BSI C5 BCM, OPS - Daily encrypted backups, held separately, kept 35 days In place - Backup restore tested every quarter Planned · Nov 2026 - Continuity and recovery plan, exercised every year Planned · Dec 2026 ### People and suppliers ISO/IEC 27001 Annex A A.5.19 to A.5.22, A.6.3, A.6.6 · BSI C5 HR, SSO - Confidentiality terms for every employee and contractor To confirm · Oct 2026 - Security and privacy training when people join and every year Planned · Nov 2026 - Security review of every sub-processor before use and every year In progress · Nov 2026 - Written terms stopping AI providers training on partner data In progress · Nov 2026 Every control above will be operating by 1 January 2027, except the ISO/IEC 27001 internal audit (March 2027), the certificate (June 2027) and full accessibility beyond sign-up and purchase (June 2027). The references are a map of which standard each area answers, not a claim of certification. Recovery targets: we aim to lose no more than 24 hours of data and to be back up within 24 hours. For NIS2 supply chain reviews ## The supplier measures NIS2 expects. If your company is an essential or important entity under NIS2 (in Germany, under the new BSI Act), you must manage the security of your suppliers. Social networking platforms are listed in Annex II of the Directive. - **The Article 21 measures** are the controls above: risk management, access, encryption, logging, vulnerability handling, backups and continuity, staff and supplier security. - **Notice fast enough for your deadlines.** First notice within 12 hours, against your 24-hour early warning. See [Incidents](https://www.datingapi.io/trust/incidents). - **Your checks.** We complete your own security questionnaire, and you can audit us once a year or after an incident. Laws and standards on this page ## What these controls answer. ### NIS2 Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 In progress · Jan 2027 Official text: [EUR-Lex](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) What matters Social networking platforms are listed in Annex II. Regulated partners must manage supplier security (Article 21(2)(d)) and report incidents in 24 hours, 72 hours and one month (Article 23). Our part Meet the Article 21 measures as your supplier, and give you notice fast enough for your Article 23 deadlines. ### NIS2 Implementation Act and the new BSI Act (NIS2UmsuCG, BSIG) In progress · Jan 2027 Official text: [bsi.bund.de](https://www.bsi.bund.de) What matters In force since 6 December 2025. German companies in scope must register with the BSI and pass security duties down to their suppliers by contract. Our part Meet the NIS2 measures, and support your supplier checks with our questionnaire answers and audit rights. ### ISO/IEC 27001:2022 In progress · target June 2027 Official text: [iso.org](https://www.iso.org/standard/27001) What matters Information security management system, audited by an accredited body. Our part Build the system, book the auditor by 15 December 2026, certificate targeted for June 2027. ### BSI C5 cloud computing criteria catalogue Partly in place Official text: [bsi.bund.de](https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/kriterienkatalog-c5.html) What matters The cloud security criteria German buyers often ask about. Our part Our controls are mapped to the C5 domains on the Security page. No C5 attestation yet. More in the Trust Center [### Company and continuity Who we are, who signs, and what protects you if anything goes wrong Open](https://www.datingapi.io/trust/company)[### Privacy and data transfers Our role as processor, sensitive data, retention and transfers Open](https://www.datingapi.io/trust/privacy)[### Sub-processors Who else handles member data, where, and under which safeguard Open](https://www.datingapi.io/trust/subprocessors)[### Age checks and biometric data How age and ID checks will work, and why none run until 30 November Open](https://www.datingapi.io/trust/age-and-identity)[### Moderation and online safety Reports, decisions, appeals and the DSA and Online Safety Act duties Open](https://www.datingapi.io/trust/online-safety)[### AI register Every AI system on the platform, its status and how the AI Act treats it Open](https://www.datingapi.io/trust/ai)[### Incidents Our notice times, set against your own legal deadlines Open](https://www.datingapi.io/trust/incidents)[### Laws register Every law we build for, with its official text and who carries each duty Open](https://www.datingapi.io/trust/laws) Questions for our security or privacy team? [security@highintentmedia.com](mailto:security@highintentmedia.com) and [privacy@highintentmedia.com](mailto:privacy@highintentmedia.com). Or [request the security pack](https://www.datingapi.io/trust#request).