Security and compliance

Answers to the questions that security and compliance teams at our customers usually ask about certifications, the ENS, NIS2, GDPR, audits and vulnerability management. For support response times and committed availability, see Support. For the incident history, see Service status.

Certifications

Certification or reference	Scope	What it covers
ISO 27001	Company	Information security management system.
ISO 27701	Company	Privacy management system.
LINCE	Company	CCN-CERT security certification.
CPSTIC, HIGH level	Product	Listed in the CCN-CERT CPSTIC catalog at the HIGH level, the maximum level of the Spanish National Security Framework (ENS).
CCN-STIC 1633	Product	Ironchip’s secure use procedure guide, from the National Cryptologic Center.

Does Ironchip help comply with the ENS?

Yes. Ironchip is listed in the CCN-CERT catalog at the HIGH level, the maximum level of the Spanish National Security Framework (ENS). The CCN-STIC 1633 guide (Ironchip’s secure use procedure) is also available.

How does Ironchip help comply with NIS2?

NIS2 requires MFA for remote access (VPN, RDP, Citrix), MFA for privileged accounts, access traceability, onboarding and offboarding management, and detection of anomalous locations. Ironchip directly covers all of these requirements.

Ironchip’s internal NIS2 checklist maps each control to a platform capability, including log retention of 6 months or more.

Does Ironchip comply with GDPR for location data?

Yes. The electromagnetic analysis generates a technical signature (a hash of the environment), not personal geolocation data. No GPS position and no identifiable geolocation data is stored. Ironchip’s ISO 27701 certification validates its privacy management system. More detail in Location data privacy.

What does Ironchip provide for a security audit or PCI DSS compliance?

• Complete, auditable logs of all access attempts, both successful and failed.
• Traceability of who accesses what, when, and from where.
• Alerts for access outside the usual profile.
• Documented automatic blocking of suspicious access.
• Exportable evidence for ENS, NIS2, ISO 27001, and PCI DSS.
• Configurable log retention: a minimum of 6 months for NIS2 and 1 year for PCI DSS.

How do I report a vulnerability in an Ironchip component?

Write to security@ironchip.com. For any other inquiry, use the general contact: info@ironchip.com. Ironchip’s security.txt file is at www.ironchip.com/.well-known/security.txt.

Ironchip runs an active responsible disclosure process:

• The CISO responds within 24 to 48 hours.
• The CPO directly handles critical component bugs, with proactive notification to the customer.

See the commitments of the process in Responsible vulnerability disclosure.