Soma1. Marketing website safeguards
This marketing website uses a static design with local assets and no third-party scripts, analytics, forms or payment collection. Its production Caddy configuration specifies HTTPS redirects, a same-origin Content Security Policy, restricted framing, MIME sniffing protection and a referrer policy. These controls reduce exposure; they are not a certification or guarantee against every attack.
2. Product deployment assurance
EU private cloud, on-premises and hybrid deployments require their own verification of access boundaries, encryption, logging, supplier access, backup restoration, patching and incidents. The TOM schedule defines evidence to request; the responsibility model assigns owners. Do not infer fixed algorithms, retention, uptime, MFA enforcement or completed penetration tests from this overview.
Ask EUTS for evidence relevant to your configuration. Customer data must not enter an unapproved external model or support channel. AI safeguards and an assessed data flow form part of deployment approval.
3. Certification status
The SomaHQ site describes EUTS’s alignment work around GDPR, the EU AI Act, ISO/IEC 27001 and SOC 2. It describes ISO certification as in progress and SOC 2 examination as in preparation. These are not completed certifications or audit opinions. A supplier certificate covers that supplier’s stated scope and does not certify SomaHQ or your organisation. Request current scope and evidence before relying on an assurance claim.
4. Reporting vulnerabilities and incidents
Email contact@euts.ai with “SomaHQ security report”, affected URL or version, impact and minimal reproduction steps. Do not include live credentials or unredacted records; request a suitable secure channel first. This is not a guaranteed 24-hour incident line. Contracted customers should also use their agreed escalation route.
A reporting channel does not authorise scanning, disruption, obtaining others’ data or bypassing controls. Use only evidence you may lawfully obtain, stop if others’ data is exposed and coordinate disclosure responsibly. Processor breach duties are in the DPA.
SomaHQ · EUTS UG (haftungsbeschränkt)
contact@euts.ai · Legal hub