Compliance, described carefully.

Our internal reviews consider requirements that may apply in Mexico, the United States, Canada, the European Union and Russia. We assess obligations in context rather than treating a list of laws as proof of compliance.

Where a customer or engagement requires a specific control, allocation of responsibilities and evidence should be agreed in the applicable contract and reviewed with qualified counsel.

For applicable RLS policies, we use role- and user-based testing, assisted analysis and a human approval step. These are internal engineering and review practices, not an external audit, attestation, or certification of the company.

All team members hold individual certifications related to ISO/IEC 27001, including an internal auditor. These do not certify The Stuffs Company. We do not currently represent that the organization operates a certified information security management system.

Enterprise teams can contact hello@thestuffs.company to discuss service-specific controls and available documentation. We share evidence only when approved for the relevant engagement.