Trust Center

The scope of the ISO/IEC 27001:2022 certification covers all elements of the IT-infrastructure and ICT customer services of the entities Aginion SA and Aginion Luxembourg.

The Statement of Applicability lists all controls applicable under Aginion’s ISO/IEC 27001:2022 Information Security Management System (ISMS), indicating their implementation status and justification for inclusion or exclusion.

The report summarizes the methodology, scope, and results of recent internal and external penetration tests performed on Aginion’s infrastructure and services

The latest SOC 2 Type 2 Report will be published here once it becomes available (Q2 2026)

The DPA defines Aginion’s commitments and responsibilities as a data processor under GDPR, outlining data handling, security, and confidentiality measures for customer and end-user information.

These amendments address contractual provisions required under the EU Digital Operational Resilience Act (DORA), ensuring that customer agreements reflect Aginion’s obligations regarding ICT risk management, reporting, and resilience.

This policy describes Aginion’s approach to maintaining critical operations during disruptive events, including recovery objectives, backup strategies, testing schedules, and roles and responsibilities.

The policy defines how Aginion detects, reports, and responds to security incidents, covering roles, escalation procedures, and post-incident review requirements to ensure timely and effective remediation.

This policy outlines Aginion’s framework for compliance with the EU Digital Operational Resilience Act (DORA), detailing governance, risk management, testing, and reporting measures applicable to ICT services.

The policy explains Aginion’s data protection principles and operational controls for compliance with the General Data Protection Regulation (GDPR), including lawful processing, data subject rights, and retention practices.

This policy sets out Aginion’s approach to meeting obligations under the California Consumer Privacy Act (CCPA), describing data categories collected, rights of California residents, and procedures for data requests.

The policy details Aginion’s governance approach to Artificial Intelligence under the EU AI Act, including system classification, risk management, documentation, and transparency requirements for AI-based services.

Access to systems and data is granted based on job role and verified business need.

All access requests require documented approval from management before provisioning.

Remote access to production systems requires MFA for authorized personnel.

All accounts use unique usernames and strong authentication mechanisms, such as hardware tokens or SSH keys.

Privileged access to production networks is limited to authorized users only.

Production datastore access requires secure, unique authentication methods.

Firewall administration is restricted to authorized personnel with a business need.

Granted, changed, or revoked based on documented authorization; reviewed quarterly.

Regular backups of production data are stored in separate, secure locations.

Data is replicated to a secondary data center with automated failure alerts.

Sensitive customer data is encrypted in storage.

All remote connections use approved encryption protocols.

Confidential or sensitive customer data is not used in non-production environments.

Electronic media containing confidential data is securely erased or destroyed, with certificates issued.

Vendors, contractors, and employees are bound by confidentiality agreements.

Each customer’s virtual environment is isolated from other tenants and unauthorized users.

The network is segmented to restrict access to sensitive data and limit lateral movement.

Continuous monitoring tools track system health, performance, and security thresholds.

Network- and Host-based vulnerability scans are conducted daily, with critical issues tracked to remediation.

Systems are regularly patched as part of scheduled maintenance and in response to identified vulnerabilities, ensuring they remain hardened against emerging threats.

Standardized processes ensure consistent, secure deployment of system configurations.

System capacity is regularly reviewed and adjusted to meet operational demands.

Documented BC/DR plans are tested quarterly and designed for multi-site failover.

Production environments are hosted across multiple locations for redundancy.

Documented policies and procedures guide detection, response, and communication; tested twice annually.

Annual ICT resilience testing covers network, systems, and critical services, proportionate to operational complexity.

Severe but plausible disruption scenarios are tested to validate recovery capabilities.

Where feasible, resilience testing is coordinated with critical third-party providers.

BC/DR plans specify maximum tolerable downtime (MTD) and recovery time objectives (RTO) for all critical services.

Plans account for multi-jurisdictional regulatory requirements where applicable.

A formal methodology governs system development, changes, and maintenance.

Centralized log management is used to capture, retain, and analyze system events that could impact security, with alerts generated for potential threats.

Security and privacy incidents are logged, tracked, and resolved in line with documented incident response procedures, with notifications provided to relevant parties as required.

Security and privacy incidents are logged, tracked, and resolved in line with documented incident response procedures, with notifications provided to relevant parties as required.

Processes ensure major ICT incidents can be reported to regulators within mandated timelines.

Major incidents undergo formal analysis with tracked remediation actions.

Cyber threat intelligence is actively collected and applied to enhance defenses.

Participation in trusted industry sharing initiatives to exchange threat and vulnerability data.

Detailed records of incidents, testing, and remediation are maintained for regulatory review.

Detailed records of incidents, testing, and remediation are maintained for regulatory review.

Information security policies are documented, communicated, and reviewed at least twice annually.

Security responsibilities are assigned in job descriptions and policy documents.

A formal program maintains a vetted inventory of critical vendors, with quarterly reviews and security requirements.

A documented framework identifies, assesses, and monitors ICT risks on an ongoing basis, updated after significant changes.

Risk tolerance levels are defined by senior management and reviewed annually.

The Board and senior leadership review ICT risk reports, incident trends, and test results regularly.

The Board and senior leadership review ICT risk reports, incident trends, and test results regularly.

Plans are in place for replacing critical providers without service disruption.

Provider contracts include clauses covering security, performance, audit rights, and regulatory cooperation.

Employees complete security training within 14 days of hire and on a continuous basis thereafter.

A Cloud Officer is formally appointed to oversee compliance with CSSF Circular 25/882 and DORA requirements for ICT third-party services.

All new employees undergo background screening prior to hire.

An anonymous reporting channel supports the safe disclosure of security or compliance concerns.

Clear product and service details are available to both internal and external stakeholders.

An external-facing system allows users to report issues, incidents, or concerns to appropriate personnel.

We maintain an up-to-date register of all AI systems, including their risk classification under the EU AI Act.

AI systems are subject to continuous risk assessment and mitigation across their full lifecycle, from development to retirement.

A formal quality management system ensures AI systems are developed, tested, and deployed according to documented processes and standards.

High-risk and general-purpose AI systems include clear documentation on intended use, limitations, human oversight measures, and data sources.

Training, validation, and testing datasets are reviewed for accuracy, completeness, and bias, with measures in place to address discriminatory outcomes.

High-risk AI systems are designed with mechanisms to allow effective human intervention and control.

AI systems undergo ongoing performance, robustness, and cybersecurity testing to ensure safe and reliable operation.

Before deployment, high-risk AI systems undergo conformity assessment, are CE marked, and are registered in the EU AI database as required.

AI system performance is continuously monitored after deployment, with corrective actions taken where necessary.

Serious AI incidents or malfunctions are reported promptly to competent authorities, in line with regulatory requirements.

For general-purpose AI models, we follow voluntary EU Codes of Practice to enhance transparency, safety-by-design, and responsible data sourcing.