Trust, plainly stated.
We sell signed compliance attestations to companies that get audited. That means our own posture has to be auditable too. Every claim on this page is verifiable, dated, and accountable to a single named operator: Nicholas Templeman, founder, CSOAI LTD (UK Companies House 16939677).
Live signed attestations
MEOK signs its own compliance certificates with the same HMAC API customers buy. Every certificate has a verify_url any auditor can curl independently.
Articles 4, 6, 9, 10, 14, 26(9), 43, 50, 72 — full crosswalk.
Operational resilience for financial entities + ICT third-party risk.
EU + Germany BSI register + Section 30 / 32 entity classification.
Annex IV technical documentation + 24h ENISA reporting (live 11 Sep 2026).
EDPB harmonised DPIA template (14 Apr 2026) wired.
AI management system controls cross-mapped to EU AI Act articles.
Security practices
- All HMAC-signed attestations use SHA-256 with a server-side key never exposed to clients.
- Stripe webhook signatures verified on every event — fail-loud if signature header missing.
- API rate limiting: 120 req/min per IP, applied at middleware before any handler.
- No PII stored beyond email + entity name in lead-capture flow; certs purge after 365 days.
- All 234 PyPI packages signed at upload time; sigstore / SBOM roadmap Q3 2026.
- Founder is sole technical operator; access to production is single-key + audit-logged.
- Source code public on GitHub (CSOAI-ORG); third-party security review welcomed.
- Open-source AGPLv3 / MIT licensing on MCP packages; commercial features licensed separately.
Sub-processors
The current vendors that process customer data on our behalf. We notify customers of material changes via email + this page.
Policies + verifiers
Reporting a security issue
Found a vulnerability or compliance concern? Email security@csoai.org (mirrors to nicholas@csoai.org). 24-hour acknowledgement, 72-hour triage. We do not run a paid bug bounty yet but credit researchers in the next monthly trust update.
Last reviewed 27 April 2026. Material changes notified via email to active customers.
MEOK AI Labs is a trading name of CSOAI LTD · UK Companies House 16939677 · Registered England & Wales