# Security and compliance

> Ironchip's certifications, how it helps you meet ENS, NIS2, GDPR and PCI DSS requirements, what audit evidence it provides and how to report a vulnerability.

URL: https://docs.ironchip.com/en/seguridad/

Answers to the questions that security and compliance teams at our customers usually ask about certifications, the ENS, NIS2, GDPR, audits and vulnerability management. For support response times and committed availability, see [Support](https://docs.ironchip.com/en/soporte/). For the incident history, see [Service status](https://docs.ironchip.com/en/seguridad/estado/).

## Certifications

| Certification or reference | Scope   | What it covers                                                                                                                                                                                                                                                                      |
| -------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ISO 27001                  | Company | Information security management system.                                                                                                                                                                                                                                             |
| ISO 27701                  | Company | Privacy management system.                                                                                                                                                                                                                                                          |
| LINCE                      | Company | CCN-CERT security certification.                                                                                                                                                                                                                                                    |
| CPSTIC, HIGH level         | Product | Listed in the CCN-CERT [CPSTIC catalog](https://cpstic.ccn.cni.es/es/catalogo-productos-servicios-stic/383-location-based-identity-platform?ic=1) at the HIGH level, the maximum level of the Spanish National Security Framework (ENS).                                            |
| CCN-STIC 1633              | Product | Ironchip's [secure use procedure guide](https://www.ccn-cert.cni.es/es/pdf/guias/series-ccn-stic/1000-procedimientos-de-empleo-seguro/7213-ccn-stic-1633-procedimiento-de-empleo-seguro-ironchip-location-based-identity-platform/file.html), from the National Cryptologic Center. |

## Does Ironchip help comply with the ENS?

Yes. Ironchip is listed in the CCN-CERT catalog at the HIGH level, the maximum level of the Spanish National Security Framework (ENS). The [CCN-STIC 1633 guide](https://www.ccn-cert.cni.es/es/pdf/guias/series-ccn-stic/1000-procedimientos-de-empleo-seguro/7213-ccn-stic-1633-procedimiento-de-empleo-seguro-ironchip-location-based-identity-platform/file.html) (Ironchip's secure use procedure) is also available.

## How does Ironchip help comply with NIS2?

NIS2 requires MFA for remote access (VPN, RDP, Citrix), MFA for privileged accounts, access traceability, onboarding and offboarding management, and detection of anomalous locations. Ironchip directly covers all of these requirements.

Ironchip's internal NIS2 checklist maps each control to a platform capability, including log retention of 6 months or more.

## Does Ironchip comply with GDPR for location data?

Yes. The electromagnetic analysis generates a technical signature (a hash of the environment), not personal geolocation data. No GPS position and no identifiable geolocation data is stored. Ironchip's ISO 27701 certification validates its privacy management system. More detail in [Location data privacy](https://docs.ironchip.com/en/tecnologia/privacidad/).

## What does Ironchip provide for a security audit or PCI DSS compliance?

- Complete, auditable logs of all access attempts, both successful and failed.
- Traceability of who accesses what, when, and from where.
- Alerts for access outside the usual profile.
- Documented automatic blocking of suspicious access.
- Exportable evidence for ENS, NIS2, ISO 27001, and PCI DSS.
- Configurable log retention: a minimum of 6 months for NIS2 and 1 year for PCI DSS.

## How do I report a vulnerability in an Ironchip component?

Write to [security@ironchip.com](mailto:security@ironchip.com). For any other inquiry, use the general contact: [info@ironchip.com](mailto:info@ironchip.com). Ironchip's `security.txt` file is at [www.ironchip.com/.well-known/security.txt](https://www.ironchip.com/.well-known/security.txt).

Ironchip runs an active responsible disclosure process:

- The CISO responds within 24 to 48 hours.
- The CPO directly handles critical component bugs, with proactive notification to the customer.

See the commitments of the process in [Responsible vulnerability disclosure](https://docs.ironchip.com/en/seguridad/divulgacion-responsable/).