Compliance at Squillo

This page states Squillo's compliance posture as it is: what we hold, what we are preparing, and how the architecture bears on the regulations our customers care about. Every statement is dated.

Certifications

As of 2026-09-17, SOC 2 and ISO 27001 work is underway. Squillo Inc. holds no completed third-party certification yet. This page will list each certification the day it is earned, not before.

This statement was issued on 2026-09-17 and expires on 2027-03-17. After that date, treat it as stale and request a current one.

An empty list here is a statement, not an oversight. We publish only what we have a mechanism to show.

Where your data actually lives

The system of record for a Squillo user's content is storage the user owns: their cloud drive, their local disk, or a peer device they control. Access is deny-by-default, mediated by a permissioned ledger. An agent acting for a user never exceeds that user's authority. Squillo is not built to be the mass host of its customers' documents. For GDPR, CCPA, or a comparable regime, that is the starting point: in most cases, the user holds the data.

None of this is a legal conclusion. How a regulation applies to a deployment depends on the facts of that deployment; we do not make our customers' legal determinations. What Squillo Inc. collects and processes is governed by our Privacy Policy. Our data processing agreement is at /dpa. What an organization administrator can and cannot see is documented at /what-admins-see.

Compliance is a substrate, not a checklist

Squillo's compliance mechanism is r14n — Regulatory Localization. It treats regulatory controls the way internationalization treats strings: looked up for the context at hand, never hardcoded. r14n binds (scope × stakeholders × jurisdiction) to the controls that must hold, resolved from plain-TOML policy packs that compliance reviewers can read directly.

Where no reviewed pack governs a question, the system degrades to the Aggressive floor: it requires every control it knows how to enforce and records that no reviewed policy governed the decision. A missing pack makes Squillo more restrictive, never more permissive. r14n does not make anyone "legally compliant," and Squillo does not claim it does. It is an auditable convention for resolving which controls apply. The full explainer is at /r14n.

Requesting evidence

There is no self-serve evidence portal today; there are no certification reports yet to fill one. If you are evaluating Squillo for your organization and have compliance questions this page does not answer, raise them through the enterprise funnel or contact us. Sensitive material, where it exists, is shared through that relationship under NDA, never as a public download.

Last verified: 2026-09-17