RelixQ Trust Center
Evaluate RelixQ security, data handling, service reliability, secure development, AI use, compliance relationships, subprocessors, authorized scanning, and controlled procurement material without turning roadmap language into achieved assurance.
Catalog snapshot
Most recent catalog review:
How to evaluate this center
A badge never stands alone. Every detail page publishes what a statement covers, when it was reviewed, what evidence supports it, and whether the underlying artifact is public or controlled.
Status legend
Backed by named product, operational, or publication evidence in the stated scope. This is not an independent certification.
Publicly described with an identified evidence owner; production assurance may still be under review.
The design or practice is being checked against production evidence before a stronger claim is published.
Behavior and data flow depend on a connection or option the customer enables.
A target state, not an achieved control, report, certification, or contractual commitment.
RelixQ deliberately does not make this assurance claim.
Access boundary
Open descriptions of controls, product behavior, evidence relationships, boundaries, and review status.
Questionnaires, detailed architecture, contractual material, and independent reports shared only when available and approved.
Public trust library
Each topic is a maintained claim register rather than a generic policy summary.
Review the RelixQ SaaS security design, product controls, production-verification status, and evidence available to enterprise buyers.
RelixQ separates customer-operated submissions, managed repository processing, product telemetry, and customer-controlled integration egress within the SaaS service.
Review how RelixQ intends to govern design, code change, dependency risk, testing, release approval, and vulnerability remediation for the managed SaaS service.
Review the RelixQ SaaS reliability design, continuity roadmap, incident communication approach, and the service commitments that are not yet claimed.
Review where AI may assist RelixQ users, what data may be sent, how providers are governed, and which no-training or retention claims are not yet made.
RelixQ separates technical standards, customer evidence support, and vendor assurance. Product alignment is not customer certification, and assurance roadmap items are not achieved audits.
Review the current processing categories, configuration-dependent services, and the work required before a legal subprocessor list and notice process are final.
RelixQ active validation is limited to systems, applications, repositories, domains, cloud accounts, and infrastructure the customer owns or is explicitly authorized to assess.
RelixQ welcomes good-faith reports that help protect customers and the SaaS service, within a process that is still being staffed and tested.
RelixQ intends to publish dated changes to control summaries, data boundaries, subprocessors, assurance milestones, and policy status without presenting roadmap movement as achieved assurance.
Controlled material
Availability, confidentiality, requester identity, and commercial context are evaluated before controlled material is shared.
Evidence and frameworks
Framework relationships describe alignment or evidence utility. They do not silently convert product features into a RelixQ certification or a customer compliance conclusion.
NIST Cybersecurity Framework 2.0
Vendor control mapping
AICPA Trust Services Criteria / SOC 2
Assurance roadmap
ISO/IEC 27001
Assurance roadmap
Customer security and resilience programs
Customer evidence support
NIST SP 800-218 Secure Software Development Framework
Vendor control mapping
NIST AI Risk Management Framework
Vendor control mapping
NIST FIPS 203 — ML-KEM
Technical alignment
NIST FIPS 204 — ML-DSA
Technical alignment
NIST FIPS 205 — SLH-DSA
Technical alignment
NIST IR 8547 — Initial Public Draft
Technical alignment
Legal
Trust summaries explain operating posture. Legal pages remain the source for applicable policy and contractual wording.
Security reporting
Review the disclosure process before testing, and do not send credentials, customer data, or secrets over ordinary email.