Quality & Approvals — Stancor Technologies
Stancor Technologies works to documented quality systems, with every order released against approved specifications and supporting documentation.
Approvals and certifications
ISO 27001
Information Security Management
Certified ISMS covering access control, encryption, change management and incident response across every platform and the engineering teams that build them.
SOC 2 Type II
Trust Services Criteria
Independently audited over an observation window — security, availability and confidentiality controls tested in operation, not just documented. Report available under NDA.
PCI DSS SAQ-D
Payment Card Data Security
StancorPay is assessed against PCI DSS, with card data tokenised to RBI card-on-file rules so raw PAN never reaches your systems or ours.
RBI PA/PG Guidelines
Payment Aggregator Compliance
StancorPay operates as an orchestration layer above licensed aggregators — funds settle directly from your licensed provider to you, and we never hold customer money.
DPDP Act 2023
Data Protection (India)
Consent, purpose limitation, retention and erasure implemented as product features, with processing agreements naming you as data fiduciary and us as processor.
GDPR
EU Data Protection
Standard contractual clauses, EU region hosting and data subject request handling for customers with European operations or counterparties.
OWASP ASVS L2
Application Security Verification
Every release is tested against ASVS Level 2, with annual third-party penetration testing and a published remediation window by severity.
IEC 62443
Industrial & OT Security
StancorOps follows IEC 62443 zone and conduit principles — plant networks stay segmented, and edge gateways push data outbound only, never accepting inbound control.
ISO 9001:2015
Quality Management
Delivery, testing and release processes run under a certified quality system, with defect and SLA performance reported to customers each quarter.
Testing and inspection scope
- Annual third-party penetration testing (OWASP ASVS L2)
- SOC 2 Type II observation window audit
- Static and dependency scanning on every pull request
- Secrets scanning and signed container images
- Role-based access review, quarterly
- Encryption at rest (AES-256) and in transit (TLS 1.3)
- Backup restore drill, quarterly, with RPO/RTO evidence
- Incident response tabletop exercise, twice yearly
- Data residency verification (India region by default)
- Model evaluation: accuracy, citation fidelity and refusal rate per release
Documentation with every order
Release notes, test evidence and security documentation accompany every despatch. Contact Stancor Technologies for the full documentation list.