Contents
1Certifications and privacy program#
ISO/IEC 27001:2022ISO/IEC 42001:2023GDPR Compliance Assessment - Ampcus Cyber
Growstack Inc. maintains ISO/IEC 27001:2022 and ISO/IEC 42001:2023 certifications for the applicable certified scope. Certification details and supporting evidence can be provided during qualified security or procurement reviews.
Growstack Inc. has been independently assessed by Ampcus Cyber Inc. for its data-protection, privacy-governance and GDPR compliance practices across its operational and technological environments. Ampcus Cyber Certificate of GDPR Compliance AC-US-GDPR-26-00138 was issued on August 14, 2026 and is valid through August 13, 2027. The certificate states that Growstack Inc.'s applications and processes were reviewed and found compliant with GDPR requirements and identifies the assessed entity type as a Data Controller.
The Ampcus certificate states that it is for promotional use only and is not a legally binding document. Turgo does not represent this assessment as an EU GDPR Article 42 certification unless a separate approved certification expressly establishes that status. Growstack Inc. may also act as a processor or subprocessor for Customer Personal Data under the Data Processing Addendum; privacy roles depend on the processing activity.
2Information-security controls#
- Role-based access control, least privilege and controlled privileged access.
- Encryption in transit using industry-standard protocols and encryption at rest for applicable stored data.
- Security logging, monitoring, vulnerability management and incident-response processes.
- Secure development, review and controlled deployment practices.
- Backup, recovery and continuity controls appropriate to service criticality.
- Supplier security/privacy review and contractual controls for relevant subprocessors.
- Personnel confidentiality and recurring security/privacy awareness.
- Data minimization, retention and secure deletion practices based on data category and service configuration.
3AI governance#
Turgo's AI governance program addresses model/provider selection, AI risk assessment, human oversight, transparency obligations, restricted uses, vendor controls, monitoring and corrective action. Turgo's Acceptable Use Policy restricts prohibited AI practices, deceptive impersonation, unlawful automated decision-making and removal of legally required AI disclosures.
4Privacy and data processing#
Customer Personal Data is governed by the DPA. Turgo maintains a current Subprocessors & Third-Party Integrations notice and uses appropriate transfer safeguards where required. Turgo supports data-subject and regulator assistance to the extent required under the DPA and applicable law.
5Incident response#
Turgo maintains procedures to identify, assess, contain, investigate and remediate security incidents. For a confirmed Security Incident involving Customer Personal Data, Turgo provides notification to affected Customers in accordance with the DPA and applicable law.
6Data retention and deletion#
Retention periods are based on data type, product configuration, security, contractual and legal requirements. Customer Data is returned, deleted or anonymized following termination in accordance with the DPA and applicable backup cycles. Limited security, suppression, billing/tax and legal-hold records may be retained where necessary.
7Business continuity#
Turgo maintains backup, recovery, continuity and change-management practices designed to support service resilience. Specific service levels apply only where stated in an Order Form or SLA.
8Responsible disclosure and security contact#
Report suspected security vulnerabilities or incidents to info@turgo.ai. Please do not access, alter or exfiltrate data beyond what is reasonably necessary to demonstrate a vulnerability. Turgo will investigate good-faith reports and may request additional technical details.
9Procurement evidence#
Qualified customers may request available certification evidence, security questionnaires, DPA/SCC documentation and other reasonable compliance materials subject to confidentiality and security restrictions.
